CVE Feed

    Dashboard / CVE / CVE-2026-105447

    CVE-2026-105447

    A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.

    Published:Sep 30, 2026
    Last Modified:Oct 8, 2026
    EPS:Oct 5, 2026
    EPSS Score:0.00202
    CVSS Score:5.5

    Affected Products

    Vendor
    Redhat
    Product
    Quay

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114236 (CVSS 3.3) — storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, le…
    CVE-2026-85471 (CVSS 6.4) — A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in web…
    CVE-2026-109195 (CVSS 3.1) — A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other…
    CVE-2026-109194 (CVSS 6.4) — A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails t…
    CVE-2026-102576 (CVSS 4.2) — A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulti…
    CVE-2026-102295 (CVSS 5.4) — A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a re…
    CVE-2026-85469 (CVSS 8) — A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noel…
    CVE-2026-79705 (CVSS 4.5) — A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafte…
    CVE-2026-79699 (CVSS 4.4) — A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout head…
    CVE-2026-74247 (CVSS 4.2) — A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can ex…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High