A vulnerability (CVE-2026-32590) exists in Red Hat Quay's handling of resumable container image layer uploads where intermediate upload data is stored in a database using a format susceptible to tampering. This insecure deserialization (CWE-502) could enable an attacker with valid login credentials to execute arbitrary code on the Quay server. Exploitation requires authentication via the web interface or container tools like Podman. The vulnerability is fixed in Red Hat Quay 3.17.3. The issue is tracked under Red Hat advisory RHSA-2026:24833 and is rated as high severity by Red Hat.

An authenticated attacker with valid credentials can exploit this vulnerability to execute arbitrary code on the Red Hat Quay server. This could lead to full compromise of the registry service, affecting confidentiality, integrity, and availability of the system. The vulnerability requires low privileges but high attack complexity due to the need for authentication and specific conditions. No known exploits in the wild have been reported.

Red Hat has released Red Hat Quay version 3.17.3 which fixes this vulnerability. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Exploitation requires authentication, so ensuring strong credential management and access controls is also recommended. No additional mitigations are noted in the vendor advisory.