CVE-2026-32590

[CVE catalog]

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server. mirror-registry: remote code execution using pickle deserialization Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Published

Apr 8, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "mirror_registry_for_red_hat_openshift",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "quay",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "mirror_registry_for_red_hat_openshift",
      "ranges": [],
      "ecosystem": "cpe",
      "fixed_version": "",
      "provider_record_id": "NVD-CVE-2026-32590"
    },
    {
      "name": "quay",
      "ranges": [],
      "ecosystem": "cpe",
      "fixed_version": "",
      "provider_record_id": "NVD-CVE-2026-32590"
    }
  ]
}