CVE-2026-18255

Quay: quay: global read-only superuser can view robot account tokens

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay Quay 3

CVE-2019-20920

nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

CVSS 3.1 · 8.1 High EPSS 3.2% KEV · Not listed

Vendors

Handlebarsjs Redhat

Products

Handlebars Jboss Enterprise Bpms Platform Openshift and 2 more

CVE-2026-105447

Quay: quay: global read-only superuser can access build trigger write credentials

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2017-16138

nodejs-mime: Regular expression Denial of Service

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Mime Project Redhat

Products

Mime Quay

CVE-2026-102295

Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay

CVE-2026-102576

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay

CVE-2026-15927

Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Mirror Registry Mirror Registry For Red Hat Openshift Quay and 1 more

CVE-2026-93494

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Build Of Apache Camel For Spring Boot Camel Spring Boot and 5 more

CVE-2026-93561

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Build Of Apache Camel For Spring Boot Camel Spring Boot and 5 more

CVE-2026-93572

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Build Of Apache Camel For Spring Boot Camel Spring Boot and 5 more

CVE-2026-93563

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Build Of Apache Camel For Spring Boot Camel Spring Boot and 5 more

CVE-2026-93576

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Build Of Apache Camel For Spring Boot Camel Spring Boot and 4 more

CVE-2026-85469

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2026-44495

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Axios Redhat

Products

Axios Advanced Cluster Management For Kubernetes Advanced Cluster Security and 9 more

CVE-2026-74244

Quay: stripe webhook accepts forged events without signature verification in quay

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Update Service Quay Quay 3

CVE-2026-74247

Quay: ssrf via build archive_url in quay build api

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Update Service Quay Quay 3

CVE-2026-74243

Quay: unauthenticated secscan notification endpoint in quay when psk is unset

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Update Service Quay Quay 3

CVE-2026-74240

Quay: jwt claim validation bypasses in quay federated robot and sso authentication

A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Update Service Quay Quay 3

CVE-2026-74242

Quay: repository notification uuid idor in quay api

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Openshift Update Service Quay

CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed

Vendors

Akka Amazon Apache and 30 more

Products

Http Server Opensearch Data Prepper Apisix and 375 more