Description
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | mirror registry for Red Hat OpenShift 2.0 | — | — |
| Red Hat | Red Hat Quay 3.10 | — | — |
| Red Hat | Red Hat Quay 3.12 | — | — |
| Red Hat | Red Hat Quay 3.14 | — | — |
| Red Hat | Red Hat Quay 3.15 | — | — |
| Red Hat | Red Hat Quay 3.16 | — | — |
| Red Hat | Red Hat Quay 3.17 | — | — |
| Red Hat | Red Hat Quay 3.18 | — | — |
| Red Hat | Red Hat Quay 3.9 | — | — |
| Red Hat | mirror registry for Red Hat OpenShift | — | — |
Advisories 1
- WID-SEC-2026-1856 Red Hat Quay: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
References
- RHSA-2026:19375 vendor-advisory
- RHSA-2026:21017 vendor-advisory
- RHSA-2026:22465 vendor-advisory
- RHSA-2026:22629 vendor-advisory
- RHSA-2026:22840 vendor-advisory
- RHSA-2026:23361 vendor-advisory
- RHSA-2026:24833 vendor-advisory
- RHSA-2026:24853 vendor-advisory
- RHSA-2026:28441 vendor-advisory
- RHSA-2026:48085 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-32590 vdb-entry
- RHBZ#2446964 issue-tracking