Red Hat Quay 3
Monthly
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. The CVSS vector (PR:L, C:H) reflects a meaningful but bounded threat: internal network reconnaissance and sensitive data disclosure are achievable, though no public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating no observed widespread exploitation at time of analysis.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read the tokens of robot accounts belonging to repositories they are not a member of. Because these tokens are long-lived registry credentials, the read-only superuser can escalate a view-only role into full impersonation of any robot account, gaining whatever push/pull and repository permissions that robot holds. No public exploit identified at time of analysis; not listed in CISA KEV.
Red Hat Quay 3 bypasses password re-verification for sensitive operations such as token generation and robot account creation, allowing users with timed-out or idle authenticated sessions to perform privileged actions without providing valid credentials. An attacker with access to an abandoned browser session can execute sensitive operations despite the UI displaying authentication errors, resulting in unauthorized token creation, robot account manipulation, and information disclosure. CVSS 5.4 reflects moderate risk with network attack vector and low privilege requirements.
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deserialization (CWE-502) of resumable container image layer upload state stored in the database. An attacker with the privileges needed to initiate image uploads can tamper with intermediate upload data to execute arbitrary code on the Quay server. No public exploit identified at time of analysis; EPSS is low (0.06%) and CISA SSVC marks exploitation status as none, though technical impact is rated total.
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concurrent uploads by other users across the entire registry, enabling unauthorized read, modification, or cancellation of in-progress uploads in repositories they cannot access. This cross-repository attack vector affects Red Hat Quay 3.x and Mirror Registry deployments. EPSS score of 0.03% (8th percentile) indicates low predicted exploitation probability in the wild, and CISA SSVC framework rates this as non-automatable with no known exploitation, suggesting targeted risk rather than widespread threat despite the 7.4 CVSS score.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Server-side request forgery in Red Hat Quay allows an authenticated repository administrator to bypass the hostname blacklist enforced by the webhook notification feature, causing the Quay application to issue HTTP requests to attacker-chosen internal destinations such as cloud metadata endpoints or in-cluster services. Successful exploitation can disclose sensitive information returned by those internal services, though the CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate impact: the attacker must already hold a privileged in-application role, must use the webhook functionality, and the yield is bounded by which internal endpoints the Quay pod can actually reach. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is tracked by Red Hat under CVE-2026-85471 with all Quay 3 and Mirror Registry offerings listed as affected via wildcarded CPEs.
Authenticated users of Red Hat Quay 3 can retrieve auto-prune policy configurations belonging to repositories in other namespaces, exposing configuration details that should remain tenant-scoped. Exploitation requires a valid Quay account, control of a repository whose name collides with the target's repository name, and prior knowledge of the target policy's unique identifier - conditions reflected in the CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is confined to information disclosure, with no modification of data or denial of service, and no public exploit has been identified at time of analysis.
Build trigger management API in Red Hat Quay 3.x fails to verify that a requested trigger belongs to the specified repository, allowing an authenticated repository administrator to view, modify, or delete build triggers and associated write tokens in other repositories if they know the victim trigger's UUID. This is a moderate-severity authorization bypass (CWE-639) requiring prior knowledge of a random, non-enumerable UUID, which raises attack complexity (CVSS AC:H). As of analysis, no public exploit code has been identified; Red Hat has published an advisory and Bugzilla entry.
Cross-site scripting in Red Hat Quay 3 lets an unauthenticated remote attacker execute arbitrary script in a victim's authenticated browser session by tricking the user into completing login through a crafted URL, because the application does not validate the post-login redirect destination before navigating. Exploitation is tightly constrained: the deployment must be configured with direct database authentication (installs delegating to OIDC/LDAP/SSO are unaffected) and the victim must both click the malicious login link and finish authenticating through it. Severity is low-to-moderate (CVSS 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), impact is confined to the victim's own session, and no public exploit identified at time of analysis.
Cross-site scripting in the OAuth callback handler of Red Hat Quay 3 lets an unauthenticated remote attacker run arbitrary JavaScript in a logged-in user's browser session by luring that user to a crafted URL, with no attacker privileges required (PR:N) but mandatory victim interaction (UI:R), giving a CVSS 3.1 score of 5.4. Successful exploitation is scoped to the victim's Quay application session (S:U, low confidentiality and integrity impact, no availability impact), potentially exposing registry metadata or allowing actions to be performed as the victim, rather than yielding server-side compromise. The vulnerability class is CWE-79 improper neutralization of input during web page generation; no public exploit code was identified in the available intelligence at the time of analysis, and CISA KEV status was not indicated.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Symlink-based path traversal in the buildah/copier Go package allows a crafted tar archive to create files outside the intended extraction directory when the library is used outside of Buildah by a non-root caller. Buildah's own extraction path applies chroot hardening and is explicitly not affected, so real exposure sits with downstream consumers of the package - including Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux 10 in the published CPE data, plus other tagged Red Hat products - that unpack untrusted archives with it. Impact is integrity-only (no confidentiality or availability component in the assessed vector), the victim application must actually process the malicious archive (UI:R), EPSS is low at 0.25% (16th percentile), CISA's SSVC records exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email addresses - to any authenticated repository administrator who can enumerate or guess a target notification's UUID. The flaw is an Insecure Direct Object Reference (CWE-639): the notification UUID acts as the sole access control key, with no ownership check verifying that the requesting admin belongs to the repository whose notification is being accessed. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the confidentiality impact is High per CVSS due to the sensitivity of the exposed secrets.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacker who already holds a legitimately-issued token from the same configured identity provider to bypass audience (`aud`), authorized party (`azp`), and subject (`sub`) restrictions. Affected deployments include Red Hat Quay 3 and Red Hat OpenShift Update Service across all currently tracked versions. Successful exploitation yields unauthorized access to registry resources beyond the attacker's intended scope, including potential cross-account or cross-namespace read and write access within the Quay instance. No public exploit code has been identified and this CVE is not currently listed in the CISA KEV catalog.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
Stored cross-site scripting in Red Hat Quay 3.x allows an authenticated user with repository write access to upload a malicious SVG file via the filedrop endpoint, which lacks MIME type validation. The uploaded file is persisted and served inline through the CDN, meaning any victim who visits the archive URL will have attacker-controlled JavaScript execute in their browser. No public exploit has been identified at time of analysis, and exploitation requires both repository write privileges and victim interaction, limiting opportunistic mass exploitation.
Credential exposure in Red Hat Quay 3's config-tool GitLab OAuth validator allows OAuth client_id and client_secret to leak into system logs. The config-tool incorrectly appends these sensitive values as URL query parameters on POST requests to the GitLab endpoint, causing them to appear in server access logs, reverse proxy logs, and monitoring infrastructure. A highly privileged attacker with read access to those log systems can harvest the exposed OAuth credentials and use them for unauthorized GitLab API access. No public exploit code exists and this is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's config-tool allows a highly privileged attacker with config editor access to probe internal network infrastructure from the Quay pod's network position. By supplying attacker-controlled endpoints to the LDAP and SMTP validation functions - which make outbound connections without IP or hostname filtering - the attacker can enumerate internal services and map network topology behind the container boundary. The scope change (S:C) in the CVSS vector confirms that exploitation reaches systems beyond the Quay component itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization administrators to force the Quay server to make unvalidated network requests to internal services, cloud infrastructure endpoints, or otherwise restricted resources by supplying a crafted upstream registry hostname. With CVSS 5.2 and high confidentiality impact, this vulnerability requires administrator privileges and user interaction but poses significant risk to internal network exposure; no public exploit code or active exploitation (KEV) confirmed at time of analysis.
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct arbitrary requests to internal network resources via a specially crafted URL in the log export feature, potentially exposing sensitive information and compromising internal systems. CVSS 6.5 (medium severity) with confirmed authentication requirement and high confidentiality impact. No active exploitation or public exploit code identified at time of analysis.
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. The CVSS vector (PR:L, C:H) reflects a meaningful but bounded threat: internal network reconnaissance and sensitive data disclosure are achievable, though no public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating no observed widespread exploitation at time of analysis.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read the tokens of robot accounts belonging to repositories they are not a member of. Because these tokens are long-lived registry credentials, the read-only superuser can escalate a view-only role into full impersonation of any robot account, gaining whatever push/pull and repository permissions that robot holds. No public exploit identified at time of analysis; not listed in CISA KEV.
Red Hat Quay 3 bypasses password re-verification for sensitive operations such as token generation and robot account creation, allowing users with timed-out or idle authenticated sessions to perform privileged actions without providing valid credentials. An attacker with access to an abandoned browser session can execute sensitive operations despite the UI displaying authentication errors, resulting in unauthorized token creation, robot account manipulation, and information disclosure. CVSS 5.4 reflects moderate risk with network attack vector and low privilege requirements.
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deserialization (CWE-502) of resumable container image layer upload state stored in the database. An attacker with the privileges needed to initiate image uploads can tamper with intermediate upload data to execute arbitrary code on the Quay server. No public exploit identified at time of analysis; EPSS is low (0.06%) and CISA SSVC marks exploitation status as none, though technical impact is rated total.
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concurrent uploads by other users across the entire registry, enabling unauthorized read, modification, or cancellation of in-progress uploads in repositories they cannot access. This cross-repository attack vector affects Red Hat Quay 3.x and Mirror Registry deployments. EPSS score of 0.03% (8th percentile) indicates low predicted exploitation probability in the wild, and CISA SSVC framework rates this as non-automatable with no known exploitation, suggesting targeted risk rather than widespread threat despite the 7.4 CVSS score.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Server-side request forgery in Red Hat Quay allows an authenticated repository administrator to bypass the hostname blacklist enforced by the webhook notification feature, causing the Quay application to issue HTTP requests to attacker-chosen internal destinations such as cloud metadata endpoints or in-cluster services. Successful exploitation can disclose sensitive information returned by those internal services, though the CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate impact: the attacker must already hold a privileged in-application role, must use the webhook functionality, and the yield is bounded by which internal endpoints the Quay pod can actually reach. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is tracked by Red Hat under CVE-2026-85471 with all Quay 3 and Mirror Registry offerings listed as affected via wildcarded CPEs.
Authenticated users of Red Hat Quay 3 can retrieve auto-prune policy configurations belonging to repositories in other namespaces, exposing configuration details that should remain tenant-scoped. Exploitation requires a valid Quay account, control of a repository whose name collides with the target's repository name, and prior knowledge of the target policy's unique identifier - conditions reflected in the CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is confined to information disclosure, with no modification of data or denial of service, and no public exploit has been identified at time of analysis.
Build trigger management API in Red Hat Quay 3.x fails to verify that a requested trigger belongs to the specified repository, allowing an authenticated repository administrator to view, modify, or delete build triggers and associated write tokens in other repositories if they know the victim trigger's UUID. This is a moderate-severity authorization bypass (CWE-639) requiring prior knowledge of a random, non-enumerable UUID, which raises attack complexity (CVSS AC:H). As of analysis, no public exploit code has been identified; Red Hat has published an advisory and Bugzilla entry.
Cross-site scripting in Red Hat Quay 3 lets an unauthenticated remote attacker execute arbitrary script in a victim's authenticated browser session by tricking the user into completing login through a crafted URL, because the application does not validate the post-login redirect destination before navigating. Exploitation is tightly constrained: the deployment must be configured with direct database authentication (installs delegating to OIDC/LDAP/SSO are unaffected) and the victim must both click the malicious login link and finish authenticating through it. Severity is low-to-moderate (CVSS 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), impact is confined to the victim's own session, and no public exploit identified at time of analysis.
Cross-site scripting in the OAuth callback handler of Red Hat Quay 3 lets an unauthenticated remote attacker run arbitrary JavaScript in a logged-in user's browser session by luring that user to a crafted URL, with no attacker privileges required (PR:N) but mandatory victim interaction (UI:R), giving a CVSS 3.1 score of 5.4. Successful exploitation is scoped to the victim's Quay application session (S:U, low confidentiality and integrity impact, no availability impact), potentially exposing registry metadata or allowing actions to be performed as the victim, rather than yielding server-side compromise. The vulnerability class is CWE-79 improper neutralization of input during web page generation; no public exploit code was identified in the available intelligence at the time of analysis, and CISA KEV status was not indicated.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Symlink-based path traversal in the buildah/copier Go package allows a crafted tar archive to create files outside the intended extraction directory when the library is used outside of Buildah by a non-root caller. Buildah's own extraction path applies chroot hardening and is explicitly not affected, so real exposure sits with downstream consumers of the package - including Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux 10 in the published CPE data, plus other tagged Red Hat products - that unpack untrusted archives with it. Impact is integrity-only (no confidentiality or availability component in the assessed vector), the victim application must actually process the malicious archive (UI:R), EPSS is low at 0.25% (16th percentile), CISA's SSVC records exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email addresses - to any authenticated repository administrator who can enumerate or guess a target notification's UUID. The flaw is an Insecure Direct Object Reference (CWE-639): the notification UUID acts as the sole access control key, with no ownership check verifying that the requesting admin belongs to the repository whose notification is being accessed. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the confidentiality impact is High per CVSS due to the sensitivity of the exposed secrets.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacker who already holds a legitimately-issued token from the same configured identity provider to bypass audience (`aud`), authorized party (`azp`), and subject (`sub`) restrictions. Affected deployments include Red Hat Quay 3 and Red Hat OpenShift Update Service across all currently tracked versions. Successful exploitation yields unauthorized access to registry resources beyond the attacker's intended scope, including potential cross-account or cross-namespace read and write access within the Quay instance. No public exploit code has been identified and this CVE is not currently listed in the CISA KEV catalog.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
Stored cross-site scripting in Red Hat Quay 3.x allows an authenticated user with repository write access to upload a malicious SVG file via the filedrop endpoint, which lacks MIME type validation. The uploaded file is persisted and served inline through the CDN, meaning any victim who visits the archive URL will have attacker-controlled JavaScript execute in their browser. No public exploit has been identified at time of analysis, and exploitation requires both repository write privileges and victim interaction, limiting opportunistic mass exploitation.
Credential exposure in Red Hat Quay 3's config-tool GitLab OAuth validator allows OAuth client_id and client_secret to leak into system logs. The config-tool incorrectly appends these sensitive values as URL query parameters on POST requests to the GitLab endpoint, causing them to appear in server access logs, reverse proxy logs, and monitoring infrastructure. A highly privileged attacker with read access to those log systems can harvest the exposed OAuth credentials and use them for unauthorized GitLab API access. No public exploit code exists and this is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's config-tool allows a highly privileged attacker with config editor access to probe internal network infrastructure from the Quay pod's network position. By supplying attacker-controlled endpoints to the LDAP and SMTP validation functions - which make outbound connections without IP or hostname filtering - the attacker can enumerate internal services and map network topology behind the container boundary. The scope change (S:C) in the CVSS vector confirms that exploitation reaches systems beyond the Quay component itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization administrators to force the Quay server to make unvalidated network requests to internal services, cloud infrastructure endpoints, or otherwise restricted resources by supplying a crafted upstream registry hostname. With CVSS 5.2 and high confidentiality impact, this vulnerability requires administrator privileges and user interaction but poses significant risk to internal network exposure; no public exploit code or active exploitation (KEV) confirmed at time of analysis.
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct arbitrary requests to internal network resources via a specially crafted URL in the log export feature, potentially exposing sensitive information and compromising internal systems. CVSS 6.5 (medium severity) with confirmed authentication requirement and high confidentiality impact. No active exploitation or public exploit code identified at time of analysis.