Red Hat Quay 3.17.3 fixes security vulnerabilities CVE-2026-32590 and CVE-2026-32591, which are associated with CWE-502 and CWE-918. These vulnerabilities have a high severity rating with a CVSS vector indicating network attack vector, high complexity, low privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The update also resolves an issue where Quay did not log source IP addresses for push/pull operations behind OpenShift haproxy ingress controllers. The advisory does not provide explicit patch details but indicates the availability of version 3.17.3 as the solution.

The vulnerabilities impact Red Hat Quay by potentially allowing attackers to compromise confidentiality, integrity, and availability of the system due to deserialization flaws and server-side request forgery issues. The high severity rating reflects the critical nature of these impacts. However, there are no known exploits in the wild at the time of the advisory.

Apply the Red Hat Quay 3.17.3 update, which includes fixes for the identified vulnerabilities. Before updating, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance on applying updates as detailed in their documentation. No additional mitigation steps are indicated by the vendor advisory.