A flaw was found in Red Hat Quay. (CVE-2026-109194)
Description
A vulnerability in Red Hat Quay's build trigger management API allows an authenticated user with administrative access to any repository to view, modify, or delete build triggers and associated write tokens of another repository if they know the trigger's UUID. This flaw arises because the API does not verify whether the requested trigger belongs to the specified repository.
CVSS v3.1
Score 6.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109194 describes a security flaw in Red Hat Quay where the build trigger management API fails to verify repository ownership of a requested trigger. An authenticated user with admin rights on one repository can manipulate build triggers and write tokens of another repository by using the victim trigger's UUID. This vulnerability relates to improper authorization checks (CWE-639).
Potential Impact
An attacker with administrative access to any repository can gain unauthorized access to build triggers and write tokens of other repositories if they know the UUIDs. This can lead to unauthorized modification or deletion of build triggers, potentially disrupting build processes and compromising repository integrity. The CVSS 3.1 score is 6.4 (medium severity) indicating limited confidentiality impact but high integrity impact and low availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and avoid sharing trigger UUIDs publicly to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rfw7-pm7r-4ppw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-109194"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd55582cdf04f656da85aa
Added to database: 10/12/2026, 21:47:04 UTC
Last enriched: 10/12/2026, 21:59:52 UTC
Last updated: 10/13/2026, 03:48:08 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.