{"id":"CVE-2026-128824","kind":"vulnerability","aliases":["CVE-2026-128824"],"related":[],"title":"Red Hat Quay: crafted URL runs JavaScript in a user's browser","description":"A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.","summary":"Red Hat Quay's v1 registry API error handler reflects the image_id path segment back in an HTML response without escaping. A remote attacker who tricks a logged-in user into opening a crafted link can run JavaScript in that user's browser within the Quay origin and potentially take over their session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["container-registry","infrastructure","red-hat-quay","self-hosted"],"not_affected_if":["no-browser-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","triaged_at":"2026-11-13T09:52:04+00:00","updated_at":"2026-11-13T09:52:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T09:52:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Red Hat Quay: crafted URL runs JavaScript in a user's browser","impact":"medium","summary":"Red Hat Quay's v1 registry API error handler reflects the image_id path segment back in an HTML response without escaping. A remote attacker who tricks a logged-in user into opening a crafted link can run JavaScript in that user's browser within the Quay origin and potentially take over their session.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["red-hat-quay","self-hosted","container-registry"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs scripts in user's browser session on Quay","analyst_note":"Find the Red Hat advisory and the fixed Quay versions for CVE-2026-128824; the NVD entry lists no products or ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-browser-access"],"who_is_affected":"Teams that run a self-hosted or managed Red Hat Quay registry with the v1 registry API reachable by users. The sources do not state affected version ranges, so check the Quay version in use against the Red Hat advisory. Deployments with no browser-accessible Quay UI or API endpoints are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4569,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128824':15A,18A '-2026':14A,17A 'allow':114C 'api':36B,96C 'arbitrari':138C 'attack':54B,102C,122C,135C 'attacker-suppli':101C 'back':45B 'browser':12A,74B,144C 'compromis':150C 'contain':20B 'container-registri':19B 'craft':4A,65B,131C 'cross':118C 'cross-sit':117C 'cve':13A,16A 'error':37B,97C 'escap':51B 'execut':137C 'flaw':86C 'found':88C 'handler':38B,98C 'hat':2A,25B,31B,91C 'host':29B 'html':48B 'id':42B,105C 'imag':41B,104C 'infrastructur':22B 'javascript':7A,69B,139C 'link':66B 'log':59B 'logged-in':58B 'open':63B 'origin':78B,148C 'path':43B,106C 'potenti':80B,149C 'quay':3A,26B,32B,77B,92C,147C 'red':1A,24B,30B,90C 'red-hat-quay':23B 'reflect':39B,99C,116C 'registri':21B,35B,95C 'remot':53B,134C 'respons':49B,110C 'run':6A,68B 'script':120C 'segment':44B,107C 'self':28B 'self-host':27B 'serv':111C 'session':84B,154C 'site':119C 'special':130C 'suppli':103C 'take':81B 'text/html':113C 'trick':56B,124C 'url':5A,132C 'user':10A,61B,72B,126C,152C 'v1':34B,94C 'victim':142C 'visit':128C 'within':75B,145C 'without':50B 'xss':121C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted or managed Red Hat Quay registry with the v1 registry API reachable by users. The sources do not state affected version ranges, so check the Quay version in use against the Red Hat advisory. Deployments with no browser-accessible Quay UI or API endpoints are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containerregistry","infrastructure","medium","redhatquay","selfhosted"],"campaign_type":null,"search_a":"'-128824':15A,18A '-2026':14A,17A 'browser':12A 'craft':4A 'cve':13A,16A 'hat':2A 'javascript':7A 'quay':3A 'red':1A 'run':6A 'url':5A 'user':10A","search_b":"'api':36B 'attack':54B 'back':45B 'browser':74B 'contain':20B 'container-registri':19B 'craft':65B 'error':37B 'escap':51B 'handler':38B 'hat':25B,31B 'host':29B 'html':48B 'id':42B 'imag':41B 'infrastructur':22B 'javascript':69B 'link':66B 'log':59B 'logged-in':58B 'open':63B 'origin':78B 'path':43B 'potenti':80B 'quay':26B,32B,77B 'red':24B,30B 'red-hat-quay':23B 'reflect':39B 'registri':21B,35B 'remot':53B 'respons':49B 'run':68B 'segment':44B 'self':28B 'self-host':27B 'session':84B 'take':81B 'trick':56B 'user':61B,72B 'v1':34B 'within':75B 'without':50B","search_c":"'allow':114C 'api':96C 'arbitrari':138C 'attack':102C,122C,135C 'attacker-suppli':101C 'browser':144C 'compromis':150C 'craft':131C 'cross':118C 'cross-sit':117C 'error':97C 'execut':137C 'flaw':86C 'found':88C 'handler':98C 'hat':91C 'id':105C 'imag':104C 'javascript':139C 'origin':148C 'path':106C 'potenti':149C 'quay':92C,147C 'red':90C 'reflect':99C,116C 'registri':95C 'remot':134C 'respons':110C 'script':120C 'segment':107C 'serv':111C 'session':154C 'site':119C 'special':130C 'suppli':103C 'text/html':113C 'trick':124C 'url':132C 'user':126C,152C 'v1':94C 'victim':142C 'visit':128C 'within':145C 'xss':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128824","severity":null,"published_at":"2026-11-13T09:17:34+00:00","modified_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","fetched_at":"2026-11-13T09:49:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}