A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
References
Configurations
Configuration 1 (hide)
|
History
04 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Jun 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Jun 2026, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 May 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 May 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Apr 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
21 Apr 2026, 23:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2026-32589 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2446963 - Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:2.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat
Redhat mirror Registry For Red Hat Openshift Redhat quay |
08 Apr 2026, 18:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-08 18:25
Updated : 2026-06-04 16:16
NVD link : CVE-2026-32589
Mitre link : CVE-2026-32589
CVE.ORG link : CVE-2026-32589
JSON object : View
Products Affected
redhat
- mirror_registry_for_red_hat_openshift
- quay
CWE
CWE-639
Authorization Bypass Through User-Controlled Key