5.4
Medium
CVE-2026-6848 A flaw was found in Red Hat Quay
Description
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3 | Versions not published |
Other CVEs of Red Hat Quay 3
The 117 CVEs of Red Hat Quay 3 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Low
CVE-2026-85471
A flaw was found in Quay
6.4
Medium
CVE-2026-109194
A flaw was found in Red Hat Quay
6.4
Medium