CVE-2026-11569: Quay Stored XSS Vulnerability

CVE-2026-11569 Overview

CVE-2026-11569 is a stored cross-site scripting (XSS) vulnerability in Quay, the container image registry maintained by Red Hat. The filedrop endpoint accepts uploaded files without validating their MIME type. An authenticated user with repository write access can upload a malicious SVG file containing embedded JavaScript. Quay stores the file and serves it inline through the content delivery network (CDN). When a victim browses the archive URL, the embedded script executes in the victim's browser under the Quay origin. The flaw maps to CWE-79 and requires user interaction to trigger.

Critical Impact
Authenticated attackers with write access can stage stored XSS payloads that execute in any Quay user's browser session, enabling session theft, action forgery, and lateral access within the registry interface.

Affected Products

Red Hat Quay (container image registry)
Quay deployments exposing the filedrop endpoint to authenticated users
CDN-fronted Quay archive URLs serving uploaded files inline

Discovery Timeline

2026-06-08 - CVE-2026-11569 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11569

Vulnerability Analysis

The vulnerability resides in Quay's filedrop upload handler. The endpoint accepts arbitrary file uploads from authenticated users who hold write permissions on a repository. The server does not enforce an allow-list of MIME types and does not inspect file content for executable markup. As a result, an attacker can submit a Scalable Vector Graphics (SVG) document that embeds <script> elements or JavaScript event handlers.

Quay persists the file and exposes it through a CDN-backed archive URL. The CDN serves the response with an inline content disposition and an image-compatible content type. Browsers render the SVG in the document context of the Quay origin rather than treating it as an opaque download. The embedded JavaScript executes with access to cookies, tokens, and document state for that origin.

Root Cause

The root cause is missing input validation and missing output hardening on the filedrop upload path. Quay does not restrict acceptable MIME types, does not strip active content from SVG payloads, and does not force a Content-Disposition: attachment header or a sandboxed origin for user-supplied files. SVG is a polyglot format that supports script execution, so serving it inline from a trusted origin converts a benign upload into an execution vector.

Attack Vector

An attacker first obtains write access to a Quay repository through legitimate credentials, a compromised collaborator account, or a misconfigured public repository. The attacker uploads an SVG file containing a JavaScript payload to the filedrop endpoint. The attacker then shares the resulting archive URL with a target user or embeds it where a Quay user will click it. When the victim loads the URL, the browser renders the SVG inline and executes the embedded script under the Quay origin, exposing session cookies and authenticated API actions.

No verified public exploit code is available. See the Red Hat CVE-2026-11569 Advisory and the Red Hat Bugzilla Report #2486194 for vendor technical detail.

Detection Methods for CVE-2026-11569

Indicators of Compromise

Uploads to the filedrop endpoint with Content-Type: image/svg+xml or generic types such as application/octet-stream that resolve to SVG content.
Archive URLs returning SVG payloads that contain <script>, onload=, onerror=, or javascript: tokens.
Outbound browser requests to unfamiliar domains immediately after a user opens a Quay archive URL.
Unexpected Quay API calls originating from user sessions shortly after archive URL access.

Detection Strategies

Inspect Quay web server and CDN access logs for POST requests to the filedrop endpoint followed by GET requests to the corresponding archive URLs from distinct user agents.
Scan stored repository artifacts for SVG files containing script tags, event handler attributes, or xlink:href references to javascript: URIs.
Correlate authenticated user session events with referrer headers pointing to externally hosted Quay archive URLs.

Monitoring Recommendations

Forward Quay application logs, CDN logs, and identity provider events to a centralized SIEM and alert on anomalous filedrop upload volumes per user.
Monitor for new repository write grants and immediate file uploads, a common pattern when an attacker stages stored XSS payloads.
Track browser Content Security Policy (CSP) violation reports from the Quay origin to surface attempted script execution.

How to Mitigate CVE-2026-11569

Immediate Actions Required

Apply the Quay security update referenced in the Red Hat CVE-2026-11569 Advisory as soon as it is available for your deployment channel.
Audit existing filedrop uploads and remove any SVG files that contain script content or external script references.
Review repository write permissions and revoke access for accounts that do not require upload capability.
Rotate API tokens and session cookies for users who may have opened attacker-controlled archive URLs.

Patch Information

Red Hat tracks remediation through the Red Hat CVE-2026-11569 Advisory and Red Hat Bugzilla Report #2486194. Consult those references for fixed package versions and product-specific update procedures.

Workarounds

Configure the upstream CDN or reverse proxy to override responses for user-uploaded files with Content-Disposition: attachment and a non-renderable Content-Type such as application/octet-stream.
Serve user-supplied content from a separate sandbox domain that does not share cookies with the primary Quay origin.
Enforce a strict Content Security Policy on Quay archive responses that disallows inline script execution and external script sources.
Restrict the filedrop endpoint to a vetted MIME type allow-list at the web application firewall layer until the patch is deployed.

bash

# Example NGINX override forcing attachment disposition on Quay archive paths
location ~* ^/.*/filedrop/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    proxy_pass http://quay_upstream;
}