Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102576— Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

Quick assessment

Affected
Red Hat Red Hat Quay 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quay 中发现了一个漏洞。远程攻击者可以通过构造恶意链接诱导用户登录，从而导致跨站脚本攻击（XSS）。由于应用程序在重定向前未验证重定向目标地址，该漏洞允许攻击者在受害者已认证浏览器会话的上下文中执行任意脚本。成功利用此漏洞需要目标 Quay 部署启用数据库直接认证方式，且受害者必须通过恶意 URL 完成登录过程。

CVSS 4.2 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Red Hat Red Hat Quay 3 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102576

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Quay 3 - cpe:/a:redhat:quay:3

II. Public POCs for CVE-2026-102576

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102576

请登录查看更多情报信息。

Other References for CVE-2026-102576 (2)

Same Patch Batch · Red Hat · 2026-10-05 · 11 CVEs total

CVE-2026-101919 8.8 HIGH Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to contro
CVE-2026-71299 6.5 MEDIUM Maestro: maestro: rest api write endpoints registered without authentication middleware
CVE-2026-105306 6.5 MEDIUM Keycloak-services: keycloak-services: token introspection audience bypass via dynamic clie
CVE-2026-71298 6.4 MEDIUM Maestro: sql identifier injection via properties.* search filter and orderby field
CVE-2026-105302 5.7 MEDIUM Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access
CVE-2026-104030 5.5 MEDIUM Sssd: sssd: denial of service via out-of-bounds read during passkey parsing
CVE-2026-102295 5.4 MEDIUM Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter
CVE-2026-105301 4.0 MEDIUM Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker
CVE-2026-104029 3.3 LOW Sssd: sssd: denial of service via out-of-bounds read in autofs responder
CVE-2026-105326 2.5 LOW Cups: cups: argument injection in mailto notifier via notify-recipient-uri

IV. Related Vulnerabilities

Same product: Red Hat Quay 3
Same vendor: Red Hat
Same weakness: CWE-79

V. Comments for CVE-2026-102576

No comments yet

Leave a comment