CVE-2026-32589

HighCVSS 7.4/10Last modified Sep 10, 2026

Description

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Red Hatmirror registry for Red Hat OpenShift 2.0—
Red HatRed Hat Quay 3.10—
Red HatRed Hat Quay 3.12—
Red HatRed Hat Quay 3.14—
Red HatRed Hat Quay 3.15—
Red HatRed Hat Quay 3.16—
Red HatRed Hat Quay 3.17—
Red HatRed Hat Quay 3.9—
Red Hatmirror registry for Red Hat OpenShift—
Red Hatmirror registry for Red Hat OpenShift 2.0—
Red HatRed Hat Quay 3.10—
Red HatRed Hat Quay 3.12—
Red HatRed Hat Quay 3.14—
Red HatRed Hat Quay 3.15—
Red HatRed Hat Quay 3.16—
Red HatRed Hat Quay 3.17—
Red HatRed Hat Quay 3.9—
Red Hatmirror registry for Red Hat OpenShift—

References

Timeline

Published
Apr 8, 2026
Last modified
Sep 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-32597.1A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery oCVE-2026-325908.8A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the dCVE-2026-325915.5A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry forCVE-2026-325935.9Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widCVE-2026-325947.3Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, CVE-2026-325953.7Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuthCVE-2026-325967.5Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default wCVE-2026-325977.5PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined inCVE-2026-325986.5OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reCVE-2026-325995.3Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQCVE-2026-326008.2xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with eitherCVE-2026-326024.2Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condit