Description
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
Affected products
redhat: mirror registry for red hat openshift; redhat: quay
References10
- access.redhat.com/security/cve/CVE-2026-32589 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2446963 Issue TrackingVendor Advisory
- access.redhat.com/security/cve/CVE-2026-32589 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2446963 Issue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2026:19375
- access.redhat.com/errata/RHSA-2026:21017
- access.redhat.com/errata/RHSA-2026:22465
- access.redhat.com/errata/RHSA-2026:22629
- access.redhat.com/errata/RHSA-2026:22840
- access.redhat.com/errata/RHSA-2026:23361
Metrics
- CVSS 3.1
-
7.4
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - EPSS — exploit probability
- 0% percentile: 17 · as of 12 November 2026
- CWE
- CWE-639
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.