Executive brief
Red Hat Quay is a container image registry and platform used by enterprises to store and manage container images. When the security scanner pre-shared key is not configured, an unauthenticated attacker can send malicious requests to flood the notification queue and manipulate container vulnerability scan paths, leading to service unavailability and potential security scan bypass.
Technical details
This vulnerability is a missing authentication issue (CWE-306) in the security scanner notification endpoint when SECURITY_SCANNER_V4_PSK is not set. A remote unauthenticated attacker can send POST requests to the endpoint over the network with no privileges required, allowing them to flood the notification queue and inject path traversal characters into Clair API URLs. The attack causes worker resource exhaustion and blind path manipulation on the Clair host, potentially resulting in denial of service. The vulnerability primarily affects standalone Quay installations; operator-managed deployments automatically generate the pre-shared key. Mitigation involves configuring the SECURITY_SCANNER_V4_PSK parameter and restarting the service.
Affected products
- Red Hat Quay
Timeline
- 2026-08-14: disclosed