Red Hat Quay 3 — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Red Hat Quay 3, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-109194	Quay: build trigger uuid idor in quay api CWE-639	6.4	Medium	2026-10-12
CVE-2026-109195	Quay: repository auto-prune policy uuid idor in quay api CWE-639	3.1	Low	2026-10-12
CVE-2026-105447	Quay: quay: global read-only superuser can access build trigger write credentials CWE-863	5.5	Medium	2026-10-05
CVE-2026-102576	Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page CWE-79	4.2	Medium	2026-10-05
CVE-2026-102295	Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter CWE-79	5.4	Medium	2026-10-05
CVE-2026-85469	Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope CWE-1357	8.0	High	2026-09-16
CVE-2026-11569	Quay: quay: stored xss via filedrop svg upload CWE-79	5.4	Medium	2026-06-08
CVE-2026-10078	Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring CWE-598	2.7	Low	2026-05-29
CVE-2026-10052	Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints CWE-918	4.1	Medium	2026-05-29
CVE-2026-6848	Quay: red hat quay: authentication bypass allows privileged actions without valid credentials CWE-613	5.4	Medium	2026-04-22
CVE-2024-5891	Quay: unauthorized user may authenticate via oauth application token CWE-1390	4.2	Medium	2024-06-12
CVE-2023-4956	Quay: clickjacking on config-editor page severity CWE-1021	6.5	Medium	2023-11-07
CVE-2023-4959	Quay: cross-site request forgery (csrf) on config-editor page CWE-352	6.5	Medium	2023-09-15
CVE-2023-3384	Quay: stored cross site scripting CWE-79	5.4	Medium	2023-07-24

All 14 known CVE vulnerabilities affecting Red Hat Quay 3 with full Chinese analysis, references, and POCs where available.