Red Hat Quay Security Bypass Vulnerability, CVSS 5.4
Summary
CERT-Bund issued advisory WID-SEC-2026-1246 regarding a security bypass vulnerability in Red Hat Quay version 3.17 and earlier. The vulnerability carries a CVSS Base Score of 5.4 (medium) and CVSS Temporal Score of 5.0 (medium), with remote attack capability confirmed. No mitigation is currently available. Affected parties include operators running Linux and UNIX systems with Red Hat Quay deployments, who face potential circumvention of container image registry security controls by authenticated remote attackers.
“Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Quay ausnutzen, um Sicherheitsvorkehrungen zu umgehen.”
Organisations running Red Hat Quay as their container image registry should verify their installed version against the <=3.17 threshold. Because no vendor patch is yet available, security teams should evaluate compensating controls such as network segmentation, authentication hardening, and enhanced monitoring for the specific CVE once disclosed. This advisory type from a national CERT authority typically precedes coordinated vulnerability disclosure, so monitoring vendor channels for patches is the primary remediation pathway.
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund published security advisory WID-SEC-2026-1246 disclosing a security bypass vulnerability in Red Hat Quay, a distributed and highly available container image registry. The flaw affects versions up to and including 3.17 on Linux and UNIX platforms. No patch or vendor-provided mitigation is available as of the advisory date.
Operators running Red Hat Quay should assess their exposure, implement compensating controls where feasible, and monitor Red Hat security channels for available patches. The CVSS 5.4 score indicates moderate severity, but the unpatched status and availability of a working exploit vector warrant priority attention.
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1246] Red Hat Quay: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen CVSS Base Score 5.4 (mittel) CVSS Temporal Score 5.0 (mittel) Remoteangriff ja Datum 22.04.2026 Stand 23.04.2026 Mitigation nein
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
Produktbeschreibung
Red Hat Quay ist eine verteilte und hochverfügbare Container Image Registry.
Produkte
22.04.2026
- Red Hat Quay <=3.17
Angriff
Angriff
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Quay ausnutzen, um Sicherheitsvorkehrungen zu umgehen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Parties
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.