The vulnerability lies in how Red Hat Quay handles resumable container image layer uploads. During the upload process the server stores intermediate data in its database in a serialized format that is not properly safeguarded. If an attacker can modify that serialized payload, the deserialization step can trigger arbitrary code execution on the Quay host, exposing the system to full compromise. The weakness is a classic unsafe deserialization flaw, classified as CWE‑502.

The flaw affects Red Hat Quay version 3 and the Red Hat mirror registry used in OpenShift, with affected releases identified as mirror registry 1 and 2. Users deploying these components without a recent fix are vulnerable.

The CVSS base score is 7.1, indicating a high severity. EPSS data is not yet available, and the vulnerability is not in the KEV catalog, suggesting no mass exploitation yet. Nevertheless, the attack vector requires that an attacker be able to inject a crafted payload into the upload workflow, which is feasible for internal threat actors or compromised clients. Once exploited, the attacker can run arbitrary code with the permissions of the Quay service, potentially leading to full system takeover.