Red Hat Quay Reflected XSS via v1 Registry API error handler
CVE-2026-128824 Published on November 13, 2026
Quay: quay: reflected xss via image_id in v1 registry error responses
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.
Vulnerability Analysis
CVE-2026-128824 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 9 days later.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-128824 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-128824
stack.watch emails you whenever new vulnerabilities are published in Red Hat Mirror Registry or Red Hat Quay. Just hit a watch button to start following.
