CVE-2026-128824
Quay: quay: reflected xss via image_id in v1 registry error responses
- Medium 5.4
Description
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.224% likely to be exploited in the next 30 days, higher than 13.164% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 5.4CVSS 3.1, Mediumfrom the CNA (redhat)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
What to do
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | mirror registry for Red Hat OpenShift 2 |
|
| Red Hat | Red Hat Quay 3 |
|
Timeline
- 4 Nov 2026 Reported to Red Hat.
- 13 Nov 2026 Made public.
- 13 Nov 2026 Published
Weakness
Practice this bug class
HackZoneLabs has a hands-on lab on XSS (stored, reflected, DOM) (CWE-79).