Red Hat fixes critical Quay flaw exposing private images

Fixed Red Hat Quay builds have reportedly been released for a critical access-control flaw that could let someone with registry access read or overwrite private container images across every repository. If anonymous access is enabled, the reported attack requires no account. If it is disabled, any valid account may still be enough.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list

The Hacker News reports that a person able to reach a Quay registry could cross normal repository boundaries and access private images throughout that registry. SecurityWeek separately describes potential theft, repository overwriting and persistent access, although the supplied evidence does not explain the persistence mechanism.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list[2]Critical Red Hat Quay Vulnerability Could Expose Private Container Imagessecurityweek.com · rssOpen original sourceSee in source list

Private container images may contain proprietary application code and become the software deployed into production. The reported ability to both read and replace them therefore creates two distinct risks: exposure of confidential material and tampering with software that teams may later run.[2]Critical Red Hat Quay Vulnerability Could Expose Private Container Imagessecurityweek.com · rssOpen original sourceSee in source list[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list

Quay operators should identify their deployed build and move to a fixed build. Disabling anonymous access may reduce exposure, but the report says it does not close the issue because a valid account can still exploit the flaw. Until an update is complete, restricting registry reachability and reviewing image changes are prudent additional precautions, inferred from the reported attack path.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list

The supplied material supports reports of fixed builds, registry-wide private-image access and different authentication requirements depending on anonymous access. It does not provide a CVE identifier, affected versions, patched version numbers, exploitation evidence or technical root cause. One social post refers to two critical flaws with scores of 9.8 and 9.9, while the included article excerpt describes one flaw, so the evidence does not establish which score belongs to the issue summarized here.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list[3]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The Hacker News says Red Hat disclosed that anonymous access is enabled by default and that exploitation still remains possible with any valid account when anonymous access is turned off. SecurityWeek characterizes the impact as possible theft, overwriting and persistent access. These are attributed claims in the supplied reports, not independently verified findings in this evidence set.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list[2]Critical Red Hat Quay Vulnerability Could Expose Private Container Imagessecurityweek.com · rssOpen original sourceSee in source list

The available timeline is short: reports surfaced describing broad access to private images, followed by reporting that Red Hat had released fixed builds. The supplied excerpts contain no earlier discovery date, disclosure chronology or confirmation that deployments have already installed those builds.[2]Critical Red Hat Quay Vulnerability Could Expose Private Container Imagessecurityweek.com · rssOpen original sourceSee in source list[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list

2 independent groups, 2 updates, and 5 engagements.

At a high level, the reporting points to a registry authorization failure: gaining access to the registry allegedly permits reading and overwriting private images beyond the repositories a user should control. Anonymous configuration changes who can reach that path, but reportedly does not remove the underlying cross-repository access for authenticated users.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list

This account is based on brief reports from The Hacker News and SecurityWeek plus a promotional social post from The Hacker News. The article excerpt supplies the clearest claims about access conditions and fixed builds, while SecurityWeek independently summarizes possible impact. No Red Hat advisory, exploit demonstration or patch documentation is present in the supplied evidence, so vendor attribution and technical claims remain reported rather than independently confirmed here.[1]Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registrythehackernews.com · rssOpen original sourceSee in source list[2]Critical Red Hat Quay Vulnerability Could Expose Private Container Imagessecurityweek.com · rssOpen original sourceSee in source list[3]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list