CVE-2026-128824 · Infrastructure
NO FIX YET
Red Hat Quay's v1 registry API error handler reflects the image_id path segment back in an HTML response without escaping. A remote attacker who tricks a logged-in user into opening a crafted link can run JavaScript in that user's browser within the Quay origin and potentially take over their session.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted or managed Red Hat Quay registry with the v1 registry API reachable by users. The sources do not state affected version ranges, so check the Quay version in use against the Red Hat advisory. Deployments with no browser-accessible Quay UI or API endpoints are less exposed.
Not affected if no-browser-access
Who cares container-registry, red-hat-quay, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.