Skip to content
OpenAdvisories
High WID-SEC-2026-4565 3 CVEs

Red Hat Quay: Mehrere Schwachstellen

Published Nov 12, 2026 · Updated Nov 12, 2026 · de

Vendor: Red Hat Product: quay

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat Quay ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

Red Hat Quay ist eine verteilte und hochverfügbare Container Image Registry.

Vulnerabilities 3

  • Critical 9.9
    CVE-2026-110697 Public exploit

    Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens

    A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and…

    Red Hat Project Quay mirror registry for Red Hat OpenShift 2 Red Hat Quay 3.10 Ubuntu
  • Critical 9.8
    CVE-2026-123710

    Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

    A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens …

    Red Hat Project Quay mirror registry for Red Hat OpenShift 2 Red Hat Quay 3.9
  • Medium 5.4
    CVE-2026-128824

    Quay: quay: reflected xss via image_id in v1 registry error responses

    A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially cr…

    Red Hat Red Hat Quay 3 mirror registry for Red Hat OpenShift 2

Revision history

  1. #1

    Initiale Fassung

References