A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). (CVE-2026-102576)

CVE-2026-102576 describes a cross-site scripting (XSS) vulnerability in Quay. The flaw arises from the lack of validation on redirect destinations after login, allowing a remote attacker to craft a malicious login URL that executes arbitrary scripts in the context of the victim's authenticated session. Successful exploitation requires the target Quay instance to use direct database authentication and the victim to log in through the crafted link. The CVSS v3.1 base score is 4.2, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

An attacker can execute arbitrary scripts in the victim's browser session after login, potentially leading to session hijacking or other client-side impacts. The impact is limited to the confidentiality and integrity of the user's session data with no availability impact. Exploitation requires user interaction and specific authentication configuration (direct database authentication). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using direct database authentication if possible and educate users to be cautious about login links. Monitor official Quay advisories for updates and apply any official fixes once released.