CVE-2026-6848: Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
A flaw was found in Red Hat Quay. When Quay requests password re-verification for sensitive operations (e.g., token generation, robot account creation) due to session timeout, the re-authentication prompt can be bypassed. Although the UI displays an error popup for invalid credentials, the sensitive operations are still successfully executed in the background. This allows a user whose session has timed out (or an attacker with access to an idle authenticated browser session) to perform privileged actions without providing valid credentials.
The vulnerability exists in both the old and new Quay UI. Some endpoints that require fresh authentication are affected (e.g., robot account creation, token generation) while others correctly enforce reauthentication (e.g., user creation).
Upstream reference: PROJQUAY-11274
Other sources
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6848?
CVE-2026-6848 is considered a critical vulnerability due to its ability to allow unauthorized privileged actions in Red Hat Quay.
How do I fix CVE-2026-6848?
To fix CVE-2026-6848, it is recommended to update Red Hat Quay to the latest version provided by Red Hat.
What actions are impacted by CVE-2026-6848?
CVE-2026-6848 impacts sensitive operations such as token generation and robot account creation that require re-authentication.
Who is affected by CVE-2026-6848?
CVE-2026-6848 affects users of Red Hat Quay who rely on authentication for sensitive operations.
What causes CVE-2026-6848?
CVE-2026-6848 is caused by an authentication bypass flaw that allows actions without valid credentials during session timeouts.