Description
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Project Quay | quay | < 3.11.11, 2.14.0 – < 3.14.2, 3.12.0 – < 3.12.10 | 3.11.11 |
| Red Hat | Red Hat Quay 3 | — | — |
References
- RHBA-2025:8262 vendor-advisory
- RHBA-2025:8263 vendor-advisory
- RHBA-2025:8687 vendor-advisory
- RHBA-2025:8688 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-4374 vdb-entry
- RHBZ#2364267 issue-tracking