Red Hat Security Advisory: Red Hat Quay - 3.15.9
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 6.3 Medium →: upgrade Red Hat to 0.31.2 when convenient.
Data as of 13 Nov 2026, 01:27 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.31.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- Present
- Privileges Required
- Low
- User Interaction
- None
- Vulnerable system confidentiality
- None
- Vulnerable system integrity
- None
- Vulnerable system availability
- High
- Subsequent system confidentiality
- None
- Subsequent system integrity
- None
- Subsequent system availability
- None
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
- Attack Requirements: Present
- The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include: a race condition must be won to successfully exploit the vulnerability (the successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker, or the attack may need to be launched multiple times against a single target before being successful); the attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).
- Privileges Required: Low
- The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
- User Interaction: None
- The vulnerable system can be exploited without interaction from any human user, other than the attacker.
- Vulnerable system confidentiality: None
- There is no loss of confidentiality within the Vulnerable System.
- Vulnerable system integrity: None
- There is no loss of integrity within the Vulnerable System.
- Vulnerable system availability: High
- There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
- Subsequent system confidentiality: None
- There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
- Subsequent system integrity: None
- There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
- Subsequent system availability: None
- There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
Definitions: FIRST CVSS v4.0 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 21 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 12 Nov 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade BuildKit to 0.31.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| mobyBuildKit | Affected
| Fixed in
|
AI-suggested
Apply the Red Hat Quay 3.15.9 update as provided in the advisory. Ensure all previously released relevant errata are applied before updating. Follow Red Hat's documented procedures for applying the update to mitigate the critical vulnerabilities addressed in this release.
Description
Red Hat Quay 3.15.9 is a container image registry update addressing multiple security issues. This advisory provides updated container images that fix numerous bugs and vulnerabilities documented in various bugzilla entries and CVEs including CVE-2026-15792. The update is critical and intended to improve the security posture of Red Hat Quay deployments.
Impact
The vulnerabilities addressed in Red Hat Quay 3.15.9 are classified as critical, indicating they could potentially allow attackers to compromise container image registry operations or related components. The advisory does not specify exploitation in the wild but the critical severity suggests significant risk if unpatched. The update mitigates multiple security issues tracked under various CVEs and bugzilla reports.
- CWE-617Reachable Assertion (opens in a new tab)
Base weakness
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-764Multiple Locks of a Critical Resource (opens in a new tab)
Base weakness
The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Implementation
When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-776Improper Restriction of Recursive Entity References in DTDs (Billion Laughs Attack) (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-59Improper Link Resolution Before File Access (Link Following) (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-166Improper Handling of Missing Special Element (opens in a new tab)
Base weakness
The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Developers should anticipate that special elements will be removed in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-601URL Redirection to Untrusted Site (Open Redirect) (opens in a new tab)
Base weaknessLikelihood of exploit: LowOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-79Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation · Architecture and Design
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition (Infinite Loop) (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-839Numeric Range Comparison Without Minimum Check (opens in a new tab)
Base weakness
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
Implementation · Enforcement by Conversion
If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.
Implementation · Input Validation
If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-805Buffer Access with Incorrect Length Value (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1287Improper Validation of Specified Type of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-15External Control of System or Configuration Setting (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
One or more system settings or configuration elements can be externally controlled by a user.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation · Architecture and Design
Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an…
Implementation · Architecture and Design
In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-606Name not in the CWE catalogue (opens in a new tab)
- CWE-89Name not in the CWE catalogue (opens in a new tab)
- CWE-807Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:99023
- Vendor Severity
- critical
- CVE Count
- 41
- Additional Cves
- CVE-2026-32283, CVE-2026-33818, CVE-2026-39822, CVE-2026-42504, CVE-2026-49825, CVE-2026-54770, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-59879, CVE-2026-67213, CVE-2026-77403, CVE-2026-77404, CVE-2026-77406, CVE-2026-77409, CVE-2026-77410, CVE-2026-77412, CVE-2026-79921, CVE-2026-82417, CVE-2026-84375, CVE-2026-93749, CVE-2026-94603, CVE-2026-97687, CVE-2026-97689, CVE-2026-102267, CVE-2026-102268, CVE-2026-102272, CVE-2026-102273, CVE-2026-102994, CVE-2026-102996, CVE-2026-102997, CVE-2026-102998, CVE-2026-102999, CVE-2026-103000, CVE-2026-110697, CVE-2026-112390, CVE-2026-118669, CVE-2026-123710
References
- access.redhat.com/errata/RHSA-2026:99023 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102267 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102268 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102272 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102273 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102994 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102996 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102997 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102998 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102999 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-103000 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-110697 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112390 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-118669 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-123710 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15792 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32283 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33818 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-39822 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-42504 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Red Hat Quay - 3.14.10CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.16.7CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.18.3CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.17.7CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.10.28CriticalVulnerability