Vulnerability · Published Oct 12, 2026 · Assigned by redhat

CVE-2026-109195Quay: repository auto-prune policy uuid idor in quay api

Low 3.1

In plain English

A low-severity authorization bypass via user-controlled key in Red Hat Quay 3 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Quay 3	see references
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2026-109195 vdb-entry, x_refsource_REDHAT
RHBZ#2549646 issue-tracking, x_refsource_REDHAT