CVE-2026-109195: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Quay 3

This vulnerability in Red Hat Quay 3 allows an authenticated user to bypass authorization controls and access auto-prune configuration details of repositories in other namespaces. The root cause is the application's failure to properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. Successful exploitation requires the attacker to have control over a repository sharing the target repository's name and knowledge of the target policy's unique identifier.

The impact is limited to unauthorized disclosure of repository auto-prune configuration information. There is no impact on data integrity or system availability. The CVSS v3.1 base score is 3.1, reflecting a low severity due to the requirement for authentication, high attack complexity, and limited confidentiality impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109195 for current remediation guidance. Until a fix is applied, restrict repository creation and policy identifier knowledge to trusted users to reduce exploitation risk.