CVE-2025-4374: Quay: incorrect privilege assignment
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
Other sources
When an organization is used as a proxy cache and a user (or robot) pulls an image that hasn't been mirrored yet, they are granted the "Admin" permission on the newly created repository. Proxy cache feature needs to be enabled. Version affected: <= 3.14.0
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable Quay’s proxy cache feature so organizations acting as a proxy cache are handled correctly.
Quay proxy cache Proxy cache feature needs to be enabled = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4374?
CVE-2025-4374 has been classified as a high severity vulnerability due to the risk of unauthorized Admin access in Red Hat Quay.
How do I fix CVE-2025-4374?
To fix CVE-2025-4374, upgrade Red Hat Quay to version 3.14.1 or a later version where the vulnerability is addressed.
Who is affected by CVE-2025-4374?
CVE-2025-4374 affects organizations using Red Hat Quay as a proxy cache prior to version 3.14.1.
What are the implications of CVE-2025-4374?
The implications of CVE-2025-4374 include potential unauthorized access and control over newly created repositories by users or robots.
Is there a workaround for CVE-2025-4374?
A recommended workaround for CVE-2025-4374 is to restrict access to the Quay proxy cache until an upgrade can be performed.