Executive brief
A security vulnerability has been identified in Red Hat Quay, a platform used for managing and storing container images. The flaw exists in how the system handles paused or resumed image uploads, potentially allowing an attacker with valid login credentials to execute unauthorized commands on the server. If exploited, this could lead to a full system compromise, data theft, or disruption of the container registry services.
Technical details
A remote code execution (RCE) vulnerability exists in Red Hat Quay (and Mirror Registry for OpenShift) due to the use of Python's 'pickle' module for serializing and deserializing hashlib state objects. Specifically, the 'sha_state' and 'piece_sha_state' fields in the BlobUpload database model store intermediate SHA-256 and SHA-1 hash states for resumable container image layer uploads. Because pickle is inherently insecure when processing untrusted data, an attacker with the ability to modify these database entries or influence the upload process can trigger the execution of arbitrary Python code. Exploitation requires the attacker to be authenticated and able to initiate or manipulate resumable uploads. The issue is addressed in Red Hat Quay 3.16.4.
Affected products
- Red Hat Quay 3.0.0 through 3.16.3
- Red Hat Mirror Registry for Red Hat OpenShift 2.0
Timeline
- 2026-03-12: other: Vulnerability reported to Red Hat Bugzilla
- 2026-04-08: disclosed: CVE published
- 2026-05-19: patched: Red Hat released security advisory RHSA-2026:19375 and Quay 3.16.4