CVE-2026-32590: Mirror-registry: remote code execution using pickle deserialization
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Other sources
A remote code execution (RCE) vulnerability was identified in Red Hat Quay v3.12.x resulting from the unsafe use of Python's pickle module to serialize and deserialize hashlib state objects stored in the database. The affected fields — shastate and pieceshastate on the BlobUpload model — store the in-progress SHA-256 and SHA-1 hash state for resumable container image layer uploads.
Requirements to exploit: Attacker needs to be logged into the web app / initiate podman execution from host.
Component affected: Mirror Registry for OpenShift – BlobUpload functionality / affected database column shastate
Version affected: latest release
— Red Hat