REDHAT-BUG-2549645: Medium severity Red Hat Quay vulnerability

Published Oct 12, 2026

Updated

A flaw was found in Red Hat Quay. The build trigger management endpoints (GET, PUT, DELETE on /api/v1/repository/<repository>/trigger/<triggeruuid>) resolve the trigger object by its global UUID without verifying that the trigger belongs to the repository specified in the request URL. The requirerepoadmin decorator only authorizes the caller against the URL namespace/repository, not against the object a handler loads. As a result, any user who is admin of any repository can read another repository's build trigger configuration, disable it, or permanently delete it (along with its delegate write token) by supplying the target trigger's UUID. Exploitation requires knowledge of the victim trigger's random v4 UUID, which is not normally visible across organizations. The vulnerability is in endpoints/api/trigger.py, specifically the BuildTrigger class get/put/delete methods, which all call gettrigger(triggeruuid) - a UUID-only lookup with no repository/namespace scoping. The sibling endpoint BuildTriggerAnalyze.post already has the correct ownership check, confirming this is an oversight.

Affected Software

1 affected component

Red Hat Quay

Event History

Oct 12, 2026

Data Sourced

via Red Hat·01:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A user must be an administrator of at least one repository and must know the target build trigger's random v4 UUID. The UUID is not normally exposed across organizations, which limits practical exploitation but does not prevent it if the UUID is disclosed or obtained elsewhere.

What can an attacker do with a target trigger UUID?

They can read the target repository's build trigger configuration, disable the trigger, or permanently delete it. Deletion also removes the trigger's delegate write token.

Are all build-trigger operations affected?

The affected operations are GET, PUT, and DELETE requests to the build trigger management endpoint. The BuildTriggerAnalyze POST endpoint includes an ownership check and is not described as affected.

How can teams determine whether they may have been targeted?

Review access and audit records for GET, PUT, or DELETE requests to build-trigger endpoints where the repository in the request URL differs from the repository that owns the referenced trigger UUID. Unexpected trigger disablement, deletion, or loss of a delegate write token may also indicate impact.

REDHAT-BUG-2549645: Medium severity Red Hat Quay vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a target trigger UUID?

Are all build-trigger operations affected?

How can teams determine whether they may have been targeted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a target trigger UUID?

Are all build-trigger operations affected?

How can teams determine whether they may have been targeted?