Quay

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.

Published: 2025-05-06T14:49:28.660Z
Updated: 2026-02-27T16:40:01.768Z

A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification. This flaw allows an attacker to trick a user into performing a malicious action to impersonate the target user. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Published: 2021-05-27T13:50:39.000Z
Updated: 2024-08-04T16:25:43.224Z

A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.

Published: 2021-05-26T23:46:57.000Z
Updated: 2024-08-04T16:25:43.401Z

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace.

Published: 2020-08-11T13:42:26.000Z
Updated: 2024-08-04T12:39:36.208Z

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.

Published: 2020-01-21T15:44:00.000Z
Updated: 2024-08-04T19:19:18.674Z