Bug 2549645 (CVE-2026-109194)

Summary:	CVE-2026-109194 quay: Build trigger UUID IDOR in Quay API
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	doconnor
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-12 13:41:41 UTC

A flaw was found in Red Hat Quay. The build trigger management endpoints (GET, PUT, DELETE on /api/v1/repository/<repository>/trigger/<trigger_uuid>) resolve the trigger object by its global UUID without verifying that the trigger belongs to the repository specified in the request URL. The require_repo_admin decorator only authorizes the caller against the URL namespace/repository, not against the object a handler loads. As a result, any user who is admin of any repository can read another repository's build trigger configuration, disable it, or permanently delete it (along with its delegate write token) by supplying the target trigger's UUID. Exploitation requires knowledge of the victim trigger's random v4 UUID, which is not normally visible across organizations. The vulnerability is in endpoints/api/trigger.py, specifically the BuildTrigger class get/put/delete methods, which all call get_trigger(trigger_uuid) - a UUID-only lookup with no repository/namespace scoping. The sibling endpoint BuildTriggerAnalyze.post already has the correct ownership check, confirming this is an oversight.