A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized… (CVE-2026-109195)

This vulnerability in Quay allows an authenticated user to access auto-prune configuration details of repositories in namespaces they do not own. The root cause is a failure to properly enforce namespace scoping during retrieval of policy details by repository name and policy identifier. An attacker must control a repository sharing the target's name and know the unique policy identifier to exploit this flaw. The impact is limited to information disclosure of auto-prune configurations.

The impact is unauthorized disclosure of repository auto-prune configurations from other namespaces. There is no indication of impact on integrity or availability. The CVSS score is 3.1 (low), reflecting the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a fix is available, restrict repository naming and policy identifier exposure to trusted users to reduce risk.