Vulnerability · Published Oct 5, 2026 · Assigned by redhat

CVE-2026-102576Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

Medium 4.2

In plain English

A medium-severity cross-site scripting in Red Hat Quay 3 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-102576 vdb-entry, x_refsource_REDHAT
RHBZ#2543208 issue-tracking, x_refsource_REDHAT