CVE-2026-128824: Quay: quay: reflected xss via image_id in v1 registry error responses
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied imageid path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.
Other sources
A reflected cross-site scripting (XSS) flaw was found in Quay's v1 registry API. The util/http.py abort() helper builds error bodies with json.dumps() without setting a Content-Type, so Flask serves them as text/html. The v1 image endpoints (endpoints/v1/registry.py) interpolate the attacker-controlled imageid URL path segment into the 404 error message, and json.dumps does not escape angle brackets. An unauthenticated attacker can craft a URL that, when visited by a logged-in Quay user, executes arbitrary JavaScript in the registry origin, which is shared with the Quay web UI and API. Exploitation requires the victim's browser to first establish a v1 session cookie on a public repository (anonymous access is enabled by default), which an attacker page can chain via successive navigations. Confirmed in Quay 3.18.2; util/http.py is unchanged in current upstream main.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Logged-in Quay users who can be persuaded to visit an attacker-crafted URL are exposed. The impact occurs in the Quay origin shared by the registry, web UI, and API, so successful script execution could compromise the victim's session.
Does exploitation require attacker authentication or a non-default setting?
No attacker authentication is required. Exploitation relies on a v1 session cookie for a public repository; anonymous access to public repositories is enabled by default, and an attacker page can chain the required browser interaction.
What does an attacker need to do to exploit this?
The attacker must craft a URL containing a malicious image_id path segment and convince a logged-in user to visit it. The vulnerable v1 registry error response reflects that value as text/html, allowing JavaScript to execute in the victim's browser.