The vulnerability CVE-2026-32589 in Red Hat Quay's container image upload process permits an authenticated user with push access to any repository to interfere with image uploads in progress by other users, including those in repositories they lack access to. This flaw allows unauthorized reading, modification, or cancellation of another user's in-progress image upload. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Red Hat has released security advisories RHSA-2026:19375 and RHSA-2026:21017 addressing this vulnerability with updates to Red Hat Quay versions 3.16.4 and 3.14.8 respectively.

An attacker with authenticated push access can exploit this vulnerability to interfere with other users' image uploads, potentially reading, modifying, or cancelling those uploads. This could lead to unauthorized disclosure, integrity compromise, and availability disruption of container images during upload. The CVSS v3.1 base score is 7.4 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts to confidentiality, integrity, and availability.

Red Hat has released official fixes in Red Hat Quay versions 3.14.8 and 3.16.4 to address this vulnerability. Users should apply these updates promptly. Before applying these updates, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat advisories RHSA-2026:19375 and RHSA-2026:21017 for detailed update instructions. No alternative mitigations or workarounds are indicated in the vendor advisories.