This vulnerability arises from insecure deserialization of untrusted data during the resumable upload process of container image layers in Red Hat Quay, part of the mirror registry for Red Hat OpenShift. The intermediate data is stored in a database in a format susceptible to tampering, which could allow an attacker with limited privileges and requiring user interaction to execute arbitrary code on the server. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary code on the Red Hat Quay server, potentially compromising the confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data manipulation, or denial of service within the affected environment. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-32590 for current remediation guidance. Until an official fix is available, restrict access to the Red Hat Quay server and monitor for suspicious activity related to container image uploads. Avoid tampering with intermediate upload data stored in the database. Follow vendor recommendations once they are published.