5.4
Medium
CVE-2026-6848 A flaw was found in Red Hat Quay
Description
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2460119 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Quay 3
The 117 CVEs of Red Hat Quay 3 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-85471
A flaw was found in Quay
6.4
Medium
CVE-2026-109194
A flaw was found in Red Hat Quay
6.4
Medium