CVE-2026-32589: Mirror-registry: quay: insecure direct object reference in blobupload
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
Other sources
Red Hat Quay contains an Insecure Direct Object Reference (IDOR) vulnerability in the OCI blob upload protocol. Any authenticated user with push access to any repository can perform unauthorized read, write, and delete operations against in-progress blob uploads belonging to other tenants, without holding any permissions on those tenants’ repositories.
Requirements to exploit: Attacker needs to be logged into the web app / initiate curl authenticated requests.
Components affected: Mirror Registry for OpenShift – BlobUpload functionality / affected database column shastate Quay deployed on OpenShift 4.20 – BlobUpload functionality / affected database column shastate
Version affected: latest release
— Red Hat