CVE Feed

    Dashboard / CVE / CVE-2026-32589

    CVE-2026-32589

    A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

    Published:Apr 8, 2026
    Last Modified:Jun 23, 2026
    EPS:Apr 8, 2026
    EPSS Score:0.00236
    CVSS Score:7.4

    Affected Products

    Vendor
    Redhat
    Product
    Mirror Registry
    Vendor
    Redhat
    Product
    Mirror Registry For Red Hat Openshift
    Vendor
    Redhat
    Product
    Quay

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-15927 (CVSS 6.8) — A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in…
    CVE-2025-14243 (CVSS 5.3) — A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attack…
    CVE-2026-2377 (CVSS 6.5) — A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these pr…
    CVE-2026-32590 (CVSS 7.1) — A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process sto…
    CVE-2026-32591 (CVSS 5.2) — A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator confi…
    CVE-2026-2376 (CVSS 4.9) — A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended…
    CVE-2025-7777 (CVSS 6.5) — The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing a…
    CVE-2025-3528 (CVSS 8.2) — A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for Ope…
    CVE-2024-3625 (CVSS 7.3) — A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.y…
    CVE-2024-3622 (CVSS 8.8) — A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plai…

    References

    https://access.redhat.com/errata/RHSA-2026:19375
    https://access.redhat.com/errata/RHSA-2026:21017
    https://access.redhat.com/errata/RHSA-2026:22465
    https://access.redhat.com/errata/RHSA-2026:22629
    https://access.redhat.com/errata/RHSA-2026:22840
    https://access.redhat.com/errata/RHSA-2026:23361
    https://access.redhat.com/errata/RHSA-2026:24853
    https://access.redhat.com/errata/RHSA-2026:28441
    https://access.redhat.com/security/cve/CVE-2026-32589
    https://bugzilla.redhat.com/show_bug.cgi?id=2446963
    https://access.redhat.com/errata/RHSA-2026:19375
    https://access.redhat.com/errata/RHSA-2026:21017
    https://access.redhat.com/errata/RHSA-2026:22465
    https://access.redhat.com/errata/RHSA-2026:22629
    https://access.redhat.com/errata/RHSA-2026:22840
    https://access.redhat.com/errata/RHSA-2026:23361
    https://access.redhat.com/errata/RHSA-2026:24853
    https://access.redhat.com/errata/RHSA-2026:28441
    https://access.redhat.com/security/cve/CVE-2026-32589
    https://bugzilla.redhat.com/show_bug.cgi?id=2446963
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32589.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High