Red Hat Security Advisory: Red Hat Quay 3.15.6
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 8.1 High →: upgrade Red Hat shell-quote to 1.8.4 soon.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.8.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: High
- A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
- User Interaction: None
- The vulnerable system can be exploited without any interaction from any user.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: High
- There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
- Integrity: High
- There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
- Availability: High
- There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 22 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade shell-quote to 1.8.4.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| shell-quote | Affected
| Fixed in
|
npmshell-quotepkg:npm/shell-quoteOther threats | Affected
| Fixed in– |
npmshell-quotepkg:npm/shell-quoteOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Quay 3.15.6
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
Architecture and Design · Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection') (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Implementation
Avoid using CRLF as a special sequence.
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-281Improper Preservation of Permissions (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1284Improper Validation of Specified Quantity in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-256Plaintext Storage of a Password (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product stores a password in plaintext within resources such as memory or files.
Architecture and Design
Avoid storing passwords in easily accessible locations.
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1046Creation of Immutable Text Using String Concatenation (opens in a new tab)
Base weakness
The product creates an immutable text string using string concatenation operations.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-201Insertion of Sensitive Information Into Sent Data (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Requirements
Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
Implementation
Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.
System Configuration
Setup default error messages so that unexpected errors do not disclose sensitive information.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-289Authentication Bypass by Alternate Name (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Architecture and Design · Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation · Architecture and Design
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-303Name not in the CWE catalogue (opens in a new tab)
- CWE-681Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:42796
- Vendor Severity
- high
- CVE Count
- 28
- Additional Cves
- CVE-2026-10143, CVE-2026-12143, CVE-2026-32591, CVE-2026-39820, CVE-2026-39821, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39835, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42508, CVE-2026-44432, CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496, CVE-2026-44990, CVE-2026-46595, CVE-2026-46597, CVE-2026-48526
References
- access.redhat.com/errata/RHSA-2026:42796 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-10143 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-12143 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32591 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39820 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39821 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39828 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39829 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39830 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39831 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39832 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39835 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-42151 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-42154 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-42499 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-42508 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-44432 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-44486 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-44487 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-44488 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: Red Hat OpenShift API for Data ProtectionHighVulnerability
- Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: RHACS 4.10.5 security and bug fix updateHighVulnerability
- Red Hat Security Advisory: Red Hat OpenShift API for Data ProtectionHighVulnerability