What’s Vulnerable › Vulnerabilities

CVE-2026-32590: Mirror-registry: remote code execution using pickle deserialization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-08 · updated 2026-09-09
• Weakness: CWE-502

Description

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.

Affected products

• RedHat Mirror Registry For Red Hat Openshift: 2.0
• Red Hat Quay 3: 3.0.0

References

• https://access.redhat.com/errata/RHSA-2026:19375
• https://access.redhat.com/errata/RHSA-2026:21017
• https://access.redhat.com/errata/RHSA-2026:22465
• https://access.redhat.com/errata/RHSA-2026:22629
• https://access.redhat.com/errata/RHSA-2026:22840
• https://access.redhat.com/errata/RHSA-2026:23361
• https://access.redhat.com/errata/RHSA-2026:24833
• https://access.redhat.com/errata/RHSA-2026:24853
• https://access.redhat.com/errata/RHSA-2026:28441
• https://access.redhat.com/errata/RHSA-2026:48085
• https://access.redhat.com/security/cve/CVE-2026-32590
• https://bugzilla.redhat.com/show_bug.cgi?id=2446964

Get alerted when CVE-2026-32590 or the next vulnerability affects your stack