A flaw in Red Hat Quay’s container image upload process allows an authenticated user with push access to any repository to interfere with another user’s in‑progress blob upload. The attacker can read the upload data, modify it, or cancel the transfer, potentially causing corruption or denial of service. This weakness is an example of insecure direct object reference (CWE‑639).

All versions of Red Hat Quay 3 and the mirror registry for Red Hat OpenShift (versions 1 and 2) are affected. The issue applies to any runtime that permits push permissions, regardless of the target repository’s visibility to the attacker.

The CVSS score of 7.4 indicates a moderate to high severity. The EPSS score is 0.00032 (< 1%), and the vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the registry and possess push rights; no additional privileges or network reachability beyond that are required. The attack vector is therefore network‑based but relies on compromised or legitimate accounts with elevated repository permissions.