VulnerabilityModified

CVE-2026-32589

This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

HIGH 7.4EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS: 0.24% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: redhat/mirror registry for red hat openshift · redhat/quay
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.