Critical Red Hat Quay vulnerability exposes private container images

# Critical Red Hat Quay vulnerability exposes private container images

https://gcdradar.vercel.app/incidents/critical-red-hat-quay-vulnerability-exposes-private-containe · AIR-2026-1922 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical vulnerability rating declared by the vendor.
- Fix status: Patched
- First reported: 2026-11-12
- AI role: No AI role
- Products: Red Hat Quay

## Summary

A critical flaw in Red Hat Quay could allow attackers to steal private container images, overwrite repositories, and gain persistent access. Red Hat has released advisories and updates to address the issue.

## What to do

Disable anonymous access and deploy the released fixed Quay builds.

## Affected and fixed versions

- Affected: Red Hat Quay

## Latest updates

- 2026-11-12: Report notes default anonymous access in Quay and that Red Hat released fixed builds for eight Quay components. (https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html)
- 2026-11-12: Critical Red Hat Quay Vulnerability Could Expose Private Container Images (https://securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images)

## Sources

- 2026-11-12 SecurityWeek: Critical Red Hat Quay Vulnerability Could Expose Private Container Images https://securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images
- 2026-11-12 The Hacker News: Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.