CVE-2026-109195
3.1LowPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated users can read repository auto-prune configurations from other namespaces, exposing policy metadata. An attacker needs a valid Quay account, must control a repo with the exact same name as the target, and must know the target policy ID.
Root cause
Quay fails to enforce namespace boundaries when retrieving policy details by repository name and policy identifier.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Check the Red Hat advisory for fixed Quay releases as soon as published; in the interim, audit user permissions and restrict repository creation rights to trusted accounts to prevent namespace-matching repos.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.