PT-2026-34319 · Red Hat · Red Hat Quay

Davide Scrimieri · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-6848

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw exists where the password re-verification prompt for sensitive operations, such as token generation or robot account creation, can be bypassed. This allows a user with a timed-out session or an attacker with access to an idle authenticated browser session to perform privileged actions without providing valid credentials, even if the user interface displays an error for invalid credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-6848

Affected Products

Red Hat Quay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6848 · Security Note
• https://twitter.com/CVEnew/status/2047012163517309008 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-6848 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2460119 · Note
• https://twitter.com/infoflowcloud/status/2047013504666779923 · Twitter Post