CVE-2026-6848

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Quay 3	—
Red Hat	Red Hat Quay 3	—

References

https://access.redhat.com/security/cve/CVE-2026-6848Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2460119Issue Tracking, Vendor Advisory

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-68480In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker CVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports CVE-2026-684825.3Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorize CVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify CVE-2026-684854.3An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency t CVE-2026-684865.4An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with CVE-2026-684879.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-684889.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root CVE-2026-684898.7Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut CVE-2026-68498.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo CVE-2026-684908.2Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.CVE-2026-684919.4An insufficient check allowed for the overwrite of arbitrary files via a symlink.