PT-2026-31341 · Red Hat · Red Hat Quay

Published 2026-04-08 · Updated 2026-04-28 · CVE-2026-32589

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw exists in Red Hat Quay's container image upload process. An authenticated user with push access to any repository can interfere with image uploads in progress by other users, even those in repositories they do not have access to. This could allow an attacker to read, modify, or cancel another user's in-progress image upload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32589

Affected Products

Red Hat Quay

References · 7

• https://access.redhat.com/errata/RHSA-2026:19375 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2446963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32589 · Security Note
• https://access.redhat.com/errata/RHSA-2026:21017 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-32589 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041975625901113629 · Twitter Post
• https://t.me/cveNotify/161209 · Telegram Post