Mirror-registry: remote code execution using pickle deserialization
Priority MEDIUM 41CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 9 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-502.
Summary
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00537 45th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 9 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | mirror registry for Red Hat OpenShift 2.0 | — | 1782177012 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.10 | — | 1779822261 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.12 | — | 1779811412 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.14 | — | 1779689392 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.15 | — | 1780891395 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.16 | — | 1779204086 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.17 | — | 1779922205 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.17 | — | 1780604033 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.18 | — | 1784987273 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.9 | — | 1779811473 | Patch available | CNA |
| Red Hat | mirror registry for Red Hat OpenShift | — | — | No fix listed | CNA |
- mirror registry for Red Hat OpenShift 2.0 VendorRed Hat Affected — Fixed in 1782177012 Patch available CNA
- Red Hat Quay 3.10 VendorRed Hat Affected — Fixed in 1779822261 Patch available CNA
- Red Hat Quay 3.12 VendorRed Hat Affected — Fixed in 1779811412 Patch available CNA
- Red Hat Quay 3.14 VendorRed Hat Affected — Fixed in 1779689392 Patch available CNA
- Red Hat Quay 3.15 VendorRed Hat Affected — Fixed in 1780891395 Patch available CNA
- Red Hat Quay 3.16 VendorRed Hat Affected — Fixed in 1779204086 Patch available CNA
- Red Hat Quay 3.17 VendorRed Hat Affected — Fixed in 1779922205 Patch available CNA
- Red Hat Quay 3.17 VendorRed Hat Affected — Fixed in 1780604033 Patch available CNA
- Red Hat Quay 3.18 VendorRed Hat Affected — Fixed in 1784987273 Patch available CNA
- Red Hat Quay 3.9 VendorRed Hat Affected — Fixed in 1779811473 Patch available CNA
- mirror registry for Red Hat OpenShift VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
Remediation
Red Hat 10 advisories
- RHSA-2026:48085 Released 2026-07-29 · Red Hat rating ImportantRed Hat Quay 3.18.0
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:28441 Released 2026-06-23 · Red Hat rating ImportantRed Hat Openshift Mirror Registry v2.0.11
- mirror registry for Red Hat OpenShift 2.0 registry.redhat.io/openshift/mirror-registry-rhel8
- RHSA-2026:24853 Released 2026-06-09 · Red Hat rating ImportantRed Hat Quay 3.15.5
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
Show 7 more Red Hat advisories
- RHSA-2026:24833 Released 2026-06-09 · Red Hat rating ImportantRed Hat Quay 3.17.3
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:23361 Released 2026-06-04 · Red Hat rating ImportantRed Hat Quay 3.9.22
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22840 Released 2026-06-03 · Red Hat rating ImportantRed Hat Quay 3.10.22
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22629 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.12.18
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22465 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:21017 Released 2026-05-26 · Red Hat rating ImportantRed Hat Quay 3.14.8
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:19375 Released 2026-05-19 · Red Hat rating ImportantRed Hat Quay 3.16.4
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:19375
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:21017
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
Show 8 more groups
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:22629
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:22840
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:23361
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:24853
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionalityPriority LOW 29
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:22465
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:24833
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-25102 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configurationPriority LOW 25
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:28441
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobuploadPriority LOW 32
- Advisory ·
Red Hat Quay 3.10, Red Hat Quay 3.12 and 7 more products — RHSA-2026:48085
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-25102 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configurationPriority LOW 25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| mirror registry for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:22840 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:22629 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:21017 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:24853 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:19375 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:22465, RHSA-2026:24833 |
| Red Hat Quay 3.18 | Fixed | RHSA-2026:48085 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:23361 |
| mirror registry for Red Hat OpenShift 2.0 | Fixed | RHSA-2026:28441 |
Not affected: 8 products
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.18
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32590
- 2026-10-03 Alias added: GHSA-mvqc-wfv6-7764
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Red Hat Mirror Registry For Red Hat Openshift vulnerabilities
- TI-2026-25100 Mirror-registry: quay: insecure direct object reference in blobupload CVSS 3.1HIGH 7.4
- TI-2025-13017 Mirror-registry: openshift mirror registry: user enumeration via authentication error messages CVSS 3.1MEDIUM 5.3
- TI-2026-02012 Mirror-registry: quay: quay: server-side request forgery via log export functionality CVSS 3.1MEDIUM 6.5
- TI-2026-25102 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-32590 · CVE Program
- CVE-2026-32590 · NVD
- FIRST EPSS
- GHSA-mvqc-wfv6-7764 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32590 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences