Red Hat Security Advisory: Red Hat Quay - 3.16.7
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 8.2 High · fixed in Red Hat package updates →: patch Red Hat soon.
Data as of 13 Nov 2026, 01:27 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.16.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
- User Interaction: Required
- Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
- Scope: Changed
- An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
- Confidentiality: High
- There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
- Integrity: Low
- Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
- Availability: None
- There is no impact to availability within the impacted component.
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 20 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 12 Nov 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
AI-suggested
A fix is available in Red Hat Quay version 3.16.7. Users should apply this update along with all previously released relevant errata to ensure full remediation. Refer to Red Hat's official documentation on applying updates for detailed instructions. No additional mitigation steps are specified beyond applying the update.
Description
Red Hat Quay 3.16.7 is a container image registry update addressing multiple security issues. The advisory includes container images for this version and references release notes for detailed changes. The update fixes numerous bugs and vulnerabilities identified by various CVEs, including CVE-2026-49825. The vendor has released this update as a critical security advisory.
Impact
The impact is critical as per the vendor advisory, indicating that the vulnerabilities fixed in this release could potentially allow serious security breaches affecting container image registry operations. Specific impacts are not detailed in the advisory, but the presence of multiple CWEs related to memory corruption, authorization bypass, and input validation suggests risks including unauthorized access, denial of service, and potential code execution. No known exploits in the wild are reported at this time.
- CWE-166Improper Handling of Missing Special Element (opens in a new tab)
Base weakness
The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Developers should anticipate that special elements will be removed in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-839Numeric Range Comparison Without Minimum Check (opens in a new tab)
Base weakness
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
Implementation · Enforcement by Conversion
If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.
Implementation · Input Validation
If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-805Buffer Access with Incorrect Length Value (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-15External Control of System or Configuration Setting (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
One or more system settings or configuration elements can be externally controlled by a user.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation · Architecture and Design
Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an…
Implementation · Architecture and Design
In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition (Infinite Loop) (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-78Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
Architecture and Design · Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-89Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #2OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Parameterization
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
- OWASP Cheat Sheets
- Attack patterns
- Command Line Execution through SQL Injection (opens in a new tab)
- Object Relational Mapping Injection (opens in a new tab)
- SQL Injection through SOAP Parameter Tampering (opens in a new tab)
- Expanding Control over the Operating System from the Database (opens in a new tab)
- SQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1287Improper Validation of Specified Type of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:99022
- Vendor Severity
- critical
- CVE Count
- 29
- Additional Cves
- CVE-2026-77403, CVE-2026-77404, CVE-2026-77406, CVE-2026-77409, CVE-2026-77410, CVE-2026-77412, CVE-2026-79921, CVE-2026-84292, CVE-2026-84394, CVE-2026-93749, CVE-2026-94603, CVE-2026-97687, CVE-2026-97689, CVE-2026-102267, CVE-2026-102268, CVE-2026-102272, CVE-2026-102273, CVE-2026-102994, CVE-2026-102996, CVE-2026-102997, CVE-2026-102998, CVE-2026-102999, CVE-2026-103000, CVE-2026-110642, CVE-2026-110697, CVE-2026-112390, CVE-2026-118669, CVE-2026-123710
References
- access.redhat.com/errata/RHSA-2026:99022 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102267 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102268 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102272 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102273 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102994 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102996 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102997 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102998 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-102999 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-103000 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-110642 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-110697 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112390 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-118669 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-123710 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-49825 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-77403 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-77404 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-77406 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Red Hat Quay - 3.18.3CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.15.9CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.17.7CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.10.28CriticalVulnerability
- Red Hat Security Advisory: Red Hat Quay - 3.12.24CriticalVulnerability