Security Advisory catalog CVE-2026-32589
cve-program · CVE-2026-32589 Published
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-32589 Published openshift/mirror-registry-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "mirror registry for Red Hat OpenShift 2.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift/mirror-registry-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1782177012",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:mirror_registry:2.0::el8"
]
} quay/quay-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.10",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1779822261",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
]
} quay/quay-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.12",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1779811412",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
]
} quay/quay-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.14",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1779689392",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.14::el8"
]
} quay/quay-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.15",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1780891395",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
]
} quay/quay-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.16",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1779204086",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
]
} quay/quay-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.17",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1779922205",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
]
} quay/quay-rhel8 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3.9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "1779811473",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
]
} openshift/mirror-registry-rhel8 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "mirror registry for Red Hat OpenShift",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/mirror-registry-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:mirror_registry:1"
]
} Original source record · Cite this exact observation · Complete original publisher JSON