CVE-2026-32589: redhat mirror_registry_for_red_hat_openshift

Vulnerability summary

CVE-2026-32589 is a high (CVSS 7.4) vulnerability in redhat mirror_registry_for_red_hat_openshift. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.

Timeline

1. 08-04-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.