This vulnerability involves an authorization bypass through a user-controlled key in the Red Hat Quay container image upload process. Specifically, an authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, even in repositories where they lack access rights. This flaw allows unauthorized reading, modification, or cancellation of in-progress image uploads, impacting confidentiality, integrity, and availability of container images within the Red Hat OpenShift mirror registry environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and scope change with partial impacts on confidentiality, integrity, and availability.

An attacker with authenticated push access to any repository can interfere with other users' image uploads, potentially reading, modifying, or cancelling these uploads. This compromises the confidentiality, integrity, and availability of container images during the upload process. The vulnerability affects the Red Hat Quay component used in the mirror registry for Red Hat OpenShift. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-32589 for current remediation guidance. Until an official fix is available, restrict push access to trusted users only to minimize risk. Monitor Red Hat's advisory for updates on patches or workarounds.