Is CVE-2026-6848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6848 being exploited in the wild.

How severe is CVE-2026-6848?

Medium severity, with a CVSS score of 5.4, published 22 April 2026.

Is there a fix for CVE-2026-6848?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6848 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6848?

Check whether you run Redhat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6848: Red Hat Quay authentication bypass in sensitive operations re-verification

CVE-2026-6848 · Severity: medium · CVSS 5.4 · Published 2026-04-22

Red Hat Quay, a container image registry, contains a flaw where sensitive security prompts can be bypassed. When the system asks a user to re-enter their password for high-risk actions like creating robot accounts or generating access tokens, the action may succeed even if the password is wrong or missing. This could allow an unauthorized person with access to an unattended browser session to perform administrative tasks and gain persistent access to the registry.

Technologies: Redhat Quay. Vendors: Redhat.

Quick answers

Is CVE-2026-6848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6848 being exploited in the wild.
How severe is CVE-2026-6848?: Medium severity, with a CVSS score of 5.4, published 22 April 2026.
Which products and versions are affected?: Red Hat Quay 3.0.0.
Is there a fix for CVE-2026-6848?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6848 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6848?: Check whether you run Redhat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in Red Hat Quay's re-verification mechanism (CWE-613). When the application triggers a password prompt for sensitive operations—such as robot account creation or token generation—the backend fails to properly validate the success of this re-authentication before executing the requested action. While the UI may display an error message for invalid credentials, the underlying API request is processed successfully. This allows an attacker with access to an existing (but timed-out or idle) authenticated session to bypass 'sudo-mode' style protections. The flaw affects both the legacy and new Quay user interfaces.

Affected products

Red Hat Quay 3.0.0

Timeline

2026-04-21: other: Reported to Red Hat Bugzilla
2026-04-22: disclosed: Initial vulnerability disclosure
2026-05-20: advisory: NVD analysis and enrichment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.