Is CVE-2026-11569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11569 being exploited in the wild.

How severe is CVE-2026-11569?

Medium severity, with a CVSS score of 5.4, published 8 June 2026.

Is there a fix for CVE-2026-11569?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11569 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11569?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11569: Red Hat Quay stored XSS via filedrop SVG upload

CVE-2026-11569 · Severity: medium · CVSS 5.4 · Published 2026-06-08

A security vulnerability has been identified in Red Hat Quay, a container image registry. An authorized user with permission to write to a repository can upload malicious files that execute scripts in the browsers of other users who view them. While this could be used to perform actions on behalf of a victim, sensitive session cookies are protected, which limits the risk of full account takeover.

Quick answers

Is CVE-2026-11569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11569 being exploited in the wild.
How severe is CVE-2026-11569?: Medium severity, with a CVSS score of 5.4, published 8 June 2026.
Which products and versions are affected?: Red Hat Quay.
Is there a fix for CVE-2026-11569?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11569 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11569?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Red Hat Quay 'filedrop' endpoint (POST /api/v1/filedrop/). The endpoint fails to validate MIME types, allowing an authenticated attacker with repository write access to upload malicious SVG files containing embedded JavaScript. By referencing the resulting file_id in a build, the attacker can generate an archive URL served via the CDN. When a victim visits this URL, the browser renders the SVG inline and executes the script. While the script runs in the context of the Quay domain, the impact is mitigated by 'HttpOnly' and 'Secure' attributes on session cookies, preventing direct session hijacking.

Affected products

Red Hat Quay

Timeline

2026-06-08: disclosed: Initial disclosure via Red Hat and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.