REDHAT-BUG-2516140: Medium severity Red Hat Quay vulnerability
A flaw was found in Red Hat Quay's repository notification API endpoints. The GET and test-trigger endpoints in endpoints/api/repositorynotification.py look up notifications by UUID without verifying that the notification belongs to the repository specified in the URL path. An admin of any repository who knows or guesses a target notification's UUID can read the notification configuration (including webhook URLs, Slack tokens, and email addresses) and fire test notifications for another repository's notification. The DELETE and reset endpoints correctly scope by repository. Exploitation requires knowing a 128-bit notification UUID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Quay repository notification API endpoints (endpoints/api/repositorynotification.py) so only trusted admins can call the GET/test-trigger operations, since an attacker with a valid/guessable 128-bit notification UUID can read notification configuration and trigger test notifications for another repository.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2516140?
The severity of REDHAT-BUG-2516140 is medium, rated at 4.
What flaw is identified in REDHAT-BUG-2516140?
REDHAT-BUG-2516140 identifies a flaw in Red Hat Quay's repository notification API that allows looking up notifications by UUID without repository verification.
How do I mitigate REDHAT-BUG-2516140?
To mitigate REDHAT-BUG-2516140, ensure that access to the API endpoints is restricted and implement validation of notifications to confirm they belong to the specified repository.
Which software is affected by REDHAT-BUG-2516140?
REDHAT-BUG-2516140 affects Red Hat Quay.
When was REDHAT-BUG-2516140 published?
REDHAT-BUG-2516140 was published on August 14, 2026.