CVE-2026-109195: Quay: repository auto-prune policy uuid idor in quay api

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-15
Weakness: CWE-639

Description

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

Affected products

Red Hat Quay 3: all versions

References

https://access.redhat.com/security/cve/CVE-2026-109195
https://bugzilla.redhat.com/show_bug.cgi?id=2549646

Get alerted when CVE-2026-109195 or the next vulnerability affects your stack