Bug 2572952 (CVE-2026-128824)

Summary: CVE-2026-128824 quay: quay: reflected XSS via image_id in v1 registry error responses
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aruklets, bcaton, doconnor
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-13 08:13:38 UTC 
A reflected cross-site scripting (XSS) flaw was found in Quay's v1 registry API. The util/http.py _abort() helper builds error bodies with json.dumps() without setting a Content-Type, so Flask serves them as text/html. The v1 image endpoints (endpoints/v1/registry.py) interpolate the attacker-controlled image_id URL path segment into the 404 error message, and json.dumps does not escape angle brackets. An unauthenticated attacker can craft a URL that, when visited by a logged-in Quay user, executes arbitrary JavaScript in the registry origin, which is shared with the Quay web UI and API. Exploitation requires the victim's browser to first establish a v1 session cookie on a public repository (anonymous access is enabled by default), which an attacker page can chain via successive navigations. Confirmed in Quay 3.18.2; util/http.py is unchanged in current upstream main.