CVE-2026-102576

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

Published Oct 5, 2026 CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.

Analysis

Technical impact

A flaw in Red Hat Quay allows a remote attacker to trick a user into logging in through a crafted link, leading to execution of arbitrary script in the context of the victim's authenticated browser session. The application does not validate the redirect destination before navigating, so an attacker can inject malicious code that runs with the user's privileges and can be used to steal credentials, hijack sessions, or perform other malicious actions within the Quay application.

Affected Systems

Red Hat Quay 3 deployments that use direct database authentication are affected. No specific sub‑versions are listed.

Risk and Exploitability

The CVSS score of 4.2 indicates low to moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the target to use direct database authentication and the victim to follow a malicious login URL, implying a user‑interaction attack but with no additional infrastructure prerequisites.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Quay 3	affected	—

No data.

Vendor Product Versions

Red Hat

Red Hat Quay 3

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

Upgrade to a Red Hat Quay release that implements validation for the redirect_url parameter on the signin page and removes the unvalidated redirect flaw.
Disable direct database authentication if it is not required for your environment, thereby eliminating the vulnerable login flow.
Configure Quay to validate the redirect_url value against a whitelist of trusted hosts or remove the redirect_url capability from publicly accessible endpoints; alternatively, add WS‑filter rules to block malicious redirect patterns.

Generated by OpenCVE AI on October 5, 2026 at 18:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.285% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-102576
https://bugzilla.redhat.com/show_bug.cgi?id=2543208
https://nvd.nist.gov/vuln/detail/CVE-2026-102576
https://www.cve.org/CVERecord?id=CVE-2026-102576

History

Oct 6, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-102576 https://www.cve.org/CVERecord?id=CVE-2026-102576
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 5, 2026 11:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Red Hat Red Hat red Hat Quay 3
Vendors & Products		Red Hat Red Hat red Hat Quay 3

Oct 5, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.
Title		Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page
First Time appeared		Redhat Redhat quay
Weaknesses		CWE-79
CPEs		cpe:/a:redhat:quay:3
Vendors & Products		Redhat Redhat quay
References		https://access.redhat.com/security/cve/CVE-2026-102576 https://bugzilla.redhat.com/show_bug.cgi?id=2543208
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}`