CVE-2026-109195: Quay: repository auto-prune policy uuid idor in quay api
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.
Other sources
A flaw was found in Red Hat Quay. The repository auto-prune policy endpoint (GET on /api/v1/repository/<namespace>/<repository>/autoprunepolicy/<policyuuid>) resolves the policy using the repository name and policy UUID only, without scoping to the authorized namespace. Because repository names are not globally unique (every namespace may have a repository with the same name), a user who is admin of a repository named X in their own namespace can read the auto-prune policy of a repository named X in another namespace by supplying that policy's UUID. The vulnerability is in data/model/autoprune.py in the getrepositoryautoprunepolicybyuuid function, which queries by Repository.name and UUID but never joins to the User table to enforce namespace scoping. The sibling function getrepositoryautoprunepoliciesbyreponame correctly scopes by namespace. The PUT and DELETE methods for the same resource are not affected because their model queries are namespace-scoped. Exploitation requires knowledge of the victim policy's random v4 UUID and a repository with a matching name. The leaked data is limited to low-sensitivity policy configuration (prune method, value, tag pattern).
— Red Hat