Auth bypass in Red Hat Mirror Registry For Openshift
CVE-2026-32589
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (35.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Red Hat Mirror Registry For Openshift
- Red Hat Mirror Registry For Openshift 2
- Red Hat Mirror Registry For Openshift 2.0 — versions 1782177012
- Red Hat Quay 3
- Red Hat Quay 3.1 — versions 1779822261
- Red Hat Quay 3.10 — versions 1779822261
- Red Hat Quay 3.12 — versions 1779811412
- Red Hat Quay 3.14 — versions 1779689392
- Red Hat Quay 3.15 — versions 1780891395
- Red Hat Quay 3.16 — versions 1779204086
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-32589 (vdb-entry, Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:19375 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:21017 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:22465 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:22629 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:22840 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:23361 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:24853 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:28441 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-32589?
- CVE-2026-32589 is a high-severity vulnerability in Red Hat Mirror Registry For Openshift, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.4/10. Published 2026-04-08.
- How severe is CVE-2026-32589?
- High severity. CVSS v3 base score is 7.4 out of 10.