Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102295— Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

Quick assessment

Affected
Red Hat Red Hat Quay 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发现 Quay 中存在一个缺陷。OAuth 回调处理程序中的跨站脚本（XSS）漏洞允许远程攻击者在用户浏览器会话中执行任意 JavaScript 代码。通过诱使已登录用户访问精心构造的链接，攻击者可利用不正确的输入清理机制，在应用程序上下文中运行客户端脚本。成功利用该漏洞可能使攻击者能够劫持用户会话、访问敏感的注册表信息，或以用户身份执行未经授权的操作。

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Red Hat Red Hat Quay 3 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102295

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Quay 3 - cpe:/a:redhat:quay:3

II. Public POCs for CVE-2026-102295

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102295

请登录查看更多情报信息。

Other References for CVE-2026-102295 (2)

Same Patch Batch · Red Hat · 2026-10-05 · 11 CVEs total

CVE-2026-101919 8.8 HIGH Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to contro
CVE-2026-71299 6.5 MEDIUM Maestro: maestro: rest api write endpoints registered without authentication middleware
CVE-2026-105306 6.5 MEDIUM Keycloak-services: keycloak-services: token introspection audience bypass via dynamic clie
CVE-2026-71298 6.4 MEDIUM Maestro: sql identifier injection via properties.* search filter and orderby field
CVE-2026-105302 5.7 MEDIUM Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access
CVE-2026-104030 5.5 MEDIUM Sssd: sssd: denial of service via out-of-bounds read during passkey parsing
CVE-2026-102576 4.2 MEDIUM Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page
CVE-2026-105301 4.0 MEDIUM Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker
CVE-2026-104029 3.3 LOW Sssd: sssd: denial of service via out-of-bounds read in autofs responder
CVE-2026-105326 2.5 LOW Cups: cups: argument injection in mailto notifier via notify-recipient-uri

IV. Related Vulnerabilities

Same product: Red Hat Quay 3
Same vendor: Red Hat
Same weakness: CWE-79

V. Comments for CVE-2026-102295

No comments yet

Leave a comment