{"id":"CVE-2026-32590","state":"PUBLISHED","title":"Mirror-registry: remote code execution using pickle deserialization","description":"A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.","publishedAt":"2026-04-08T17:04:22.870Z","updatedAt":"2026-09-09T22:38:17.267Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat mirror registry for Red Hat OpenShift 2.0","Red Hat Red Hat Quay 3.10","Red Hat Red Hat Quay 3.12","Red Hat Red Hat Quay 3.14","Red Hat Red Hat Quay 3.15","Red Hat Red Hat Quay 3.16","Red Hat Red Hat Quay 3.17","Red Hat Red Hat Quay 3.18","Red Hat Red Hat Quay 3.9","Red Hat mirror registry for Red Hat OpenShift"],"affected":[{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift 2.0","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","versions":[{"version":"1782177012","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:mirror_registry:2.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.10","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779822261","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.12","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779811412","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.14","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779689392","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.15","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1780891395","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.16","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1779204086","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.17","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1779922205","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.17","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1780604033","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.18","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1784987273","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.9","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779811473","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"]},{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:1"]}],"references":["https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24833","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/security/cve/CVE-2026-32590","https://bugzilla.redhat.com/show_bug.cgi?id=2446964"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/32xxx/CVE-2026-32590.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-32590","state":"PUBLISHED","datePublished":"2026-04-08T17:04:22.870Z","dateUpdated":"2026-09-09T22:38:17.267Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-03-12T14:39:53.657Z"},"containers":{"cna":{"title":"Mirror-registry: remote code execution using pickle deserialization","descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server."}],"affected":[{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift 2.0","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","versions":[{"version":"1782177012","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:mirror_registry:2.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.10","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779822261","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.12","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779811412","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.14","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779689392","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.15","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1780891395","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.16","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1779204086","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.17","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1779922205","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.17","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1780604033","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.18","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1784987273","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.9","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1779811473","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"]},{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:1"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:19375","name":"RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","name":"RHSA-2026:21017","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","name":"RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","name":"RHSA-2026:22629","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","name":"RHSA-2026:22840","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","name":"RHSA-2026:23361","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24833","name":"RHSA-2026:24833","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","name":"RHSA-2026:24853","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28441","name":"RHSA-2026:28441","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","name":"RHSA-2026:48085","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32590","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446964","name":"RHBZ#2446964","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-09T22:38:17.267Z"},"datePublic":"2026-04-08T00:00:00.000Z","x_redhatCweChain":"CWE-502: Deserialization of Untrusted Data","timeline":[{"lang":"en","time":"2026-03-12T14:43:11.443Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-08T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-08T19:14:47.764287Z","id":"CVE-2026-32590","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-08T19:14:55.136Z"}}]}}}