--- id: CVE-2026-32589 title: A flaw was found in Red Hat Quay's container image upload process summary: >- A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they… severity: high cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L' cwe: - CWE-639 vendor: redhat product: mirror_registry_for_red_hat_openshift affected: - mirror_registry_for_red_hat_openshift - mirror_registry_for_red_hat_openshift = 2.0 - quay = 3.0.0 patched: - quay 3.10 - quay 3.12 - quay 3.14 - quay 3.15 - quay 3.16 - quay 3.17 - quay 3.9 - mirror_registry_for_red_hat_openshift 2.0 published: '2026-04-08' updated: '2026-09-10' sourceUpdated: '2026-09-10T13:18:10.047' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32589' references: - url: 'https://access.redhat.com/errata/RHSA-2026:19375' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:21017' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:22465' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:22629' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:22840' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:23361' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:24853' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28441' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-32589' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446963' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:19375' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21017' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22465' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22629' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22840' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23361' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24853' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28441' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-32589' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446963' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32589.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32589' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32589' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-04-08T18:01:21.450628Z' epss: 0.00243 epssPercentile: 0.1577 ingestedAt: '2026-06-29T13:24:34.823Z' --- ## Overview A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload. ## Affected - `mirror_registry_for_red_hat_openshift` - `mirror_registry_for_red_hat_openshift = 2.0` - `quay = 3.0.0` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:22840** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22840) - **RHSA-2026:22629** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22629) - **RHSA-2026:21017** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:21017) - **RHSA-2026:24853** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24853) - **RHSA-2026:19375** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19375) - **RHSA-2026:22465** · Red Hat · fixed in: Red Hat Quay 3.17 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22465) - **RHSA-2026:23361** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23361) - **RHSA-2026:28441** · Red Hat · fixed in: mirror registry for Red Hat OpenShift 2.0 · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28441) - **Red Hat VEX** · Important · affected: mirror registry for Red Hat OpenShift · no fix planned: mirror registry for Red Hat OpenShift · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32589.json)