CVE-2026-32589

HIGH

Mirror-registry: quay: insecure direct object reference in blobupload

Title source: cna

Description

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

References (2)

[Vdb Entry, X_Refsource_Redhat] https://access.redhat.com/security/cve/CVE-2026-32589

[Issue Tracking, X_Refsource_Redhat] https://bugzilla.redhat.com/show_bug.cgi?id=2446963

Scores

CVSS v3 7.4

EPSS 0.0003

EPSS Percentile 9.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (6)

Red Hat/mirror registry for Red Hat OpenShift

Red Hat/mirror registry for Red Hat OpenShift 2

Red Hat/Red Hat Quay 3

redhat/mirror_registry_for_red_hat_openshift

redhat/mirror_registry_for_red_hat_openshift 2.0

redhat/quay 3.0.0

Published Apr 08, 2026

Tracked Since Apr 08, 2026