Skip to content
OpenAdvisories
Medium WID-SEC-2026-3886 3 CVEs

Red Hat Quay: Mehrere Schwachstellen

Published Oct 12, 2026 · Updated Oct 12, 2026 · de-DE

Vendor: Red Hat Product: quay

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Quay ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

Red Hat Quay ist eine verteilte und hochverfügbare Container Image Registry.

Vulnerabilities 3

  • Medium 6.4
    CVE-2026-109194

    Quay: build trigger uuid idor in quay api

    A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view…

    Red Hat Red Hat Quay 3
  • Medium 6.4
    CVE-2026-85471

    Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

    A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending reques…

    Red Hat Red Hat Quay 3 mirror registry for Red Hat OpenShift mirror registry for Red Hat OpenShift 2
  • Low 3.1
    CVE-2026-109195

    Quay: repository auto-prune policy uuid idor in quay api

    A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping wh…

    Red Hat Red Hat Quay 3

Revision history

  1. #1

    Initiale Fassung

References