CVE-2026-102576: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Quay 3

This vulnerability in Red Hat Quay 3 involves improper neutralization of input during web page generation, specifically in the login redirect mechanism. An attacker can craft a URL that, when used by a victim to log in, executes arbitrary JavaScript in the context of the victim's authenticated session. The flaw arises because the application does not validate the redirect destination before navigating. Successful exploitation depends on the deployment using direct database authentication and the victim completing login through the malicious link.

Successful exploitation allows execution of arbitrary scripts in the victim's authenticated browser session, potentially leading to information disclosure or session manipulation. The impact is limited by the requirement for user interaction (login via malicious URL) and the use of direct database authentication. The CVSS score of 4.2 reflects a medium impact with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-102576 for current remediation guidance. Until a fix is applied, avoid using direct database authentication if possible and educate users to be cautious about login links. Monitor the vendor advisory for official fixes or workarounds.