The flaw lies in Quay's processing of LDAP referrals during authentication. When a referral is returned, the username supplied by the user is not properly escaped, allowing injection of LDAP filter metacharacters. These injected characters let an attacker query for the existence of users at the referral DN, turning the service into an oracle that reveals which accounts exist. The injection could also affect which DN is selected for password binding in multi‑domain Active Directory deployments, potentially altering authentication flow.

The vulnerability affects Red Hat OpenShift Update Service version 5 and Red Hat Quay version 3. No specific sub‑versions are listed, so all installations of the mentioned products should be considered at risk.

With a CVSS score of 4.8, the vulnerability represents a moderate risk. The EPSS value is not available, and the entry is not in CISA KEV, indicating limited public exploitation evidence. The attack requires supplying crafted usernames to the LDAP authentication endpoint, implying remote interaction. Official Red Hat CNA maintenance notes that no suitable workaround is available that meets security criteria, so mitigation relies on applying a patch, disabling LDAP authentication, or restricting referrals. While the impact is primarily enumeration and manipulation of authentication, it does not provide immediate code execution but can aid broader attacks within the environment.