CVE-2026-109194
6.4MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-639
Impact
Authenticated users with admin rights to any single repository can read, modify, or delete build triggers and write tokens in other repositories if they know the target trigger UUID. This requires an authenticated account and knowledge of the victim's build trigger UUID.
Root cause
The build trigger management API fails to validate whether a specified build trigger belongs to the requested repository (insecure direct object reference).
Affected systems
Red Hat Quay (exact versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Fix & remediation
Check the Red Hat advisory for fixed Quay container release tags once published; no workaround or interim mitigation is currently documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).