This vulnerability involves an authorization bypass through a user-controlled key in Red Hat Quay's container image upload process. Specifically, an authenticated user with push permissions on any repository can disrupt image uploads in progress by other users, even for repositories where they lack access rights. The flaw allows unauthorized read, modification, or cancellation of in-progress image uploads. The CVSS v3.1 score is 7.4 (High), with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No explicit affected versions are stated in the provided data. The vendor advisory references Red Hat Quay versions 3.14.8 and 3.16.4 as containing fixes for multiple CVEs including CVE-2026-32589.

An attacker with authenticated push access to any repository can interfere with other users' image uploads, potentially reading, modifying, or canceling those uploads. This compromises confidentiality, integrity, and availability of container images during upload. The vulnerability affects the security of container image management in Red Hat OpenShift environments using Red Hat Quay mirror registries.

Red Hat has released security advisories and updated versions of Red Hat Quay (notably 3.14.8 and 3.16.4) that address this vulnerability. Users should apply these updates after ensuring all prior relevant errata are applied. The vendor advisory URLs (https://access.redhat.com/security/cve/CVE-2026-32589 and https://access.redhat.com/errata/RHSA-2026:19375, RHSA-2026:21017) provide detailed update instructions. Patch status is confirmed by the vendor advisories indicating fixes in these Quay versions. No cloud service remediation applies as this is not a cloud service. No indication that no action is required or that the issue is already mitigated without patching.