CVE-2026-32590: Red Hat Quay RCE Vulnerability

CVE-2026-32590 Overview

A critical insecure deserialization vulnerability has been identified in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server. This vulnerability affects organizations using Red Hat Quay as their container registry solution, potentially compromising the integrity of container image supply chains.

Critical Impact

Successful exploitation could allow authenticated attackers to achieve remote code execution on the Quay server, potentially compromising the entire container registry infrastructure and all hosted container images.

Affected Products

• Red Hat Quay (versions not specified in advisory)

Discovery Timeline

• April 8, 2026 - CVE-2026-32590 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32590

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), which occurs when an application deserializes data from untrusted sources without proper validation. In the context of Red Hat Quay, the resumable upload functionality stores intermediate layer data in the database in a serialized format. When this data is later deserialized to continue or complete an upload, insufficient validation allows maliciously crafted payloads to execute arbitrary code.

The attack requires network access and low privileges (authenticated user), combined with user interaction, making it moderately complex to exploit. However, the potential impact spans complete confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause lies in the improper handling of serialized data during the resumable container image layer upload process. Red Hat Quay stores upload state information in the database to support resumable uploads—a feature that allows large container image layers to be uploaded in chunks. The vulnerability arises because this stored state data is not adequately validated before deserialization, creating an injection point for malicious serialized objects.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker to initiate a resumable upload and then manipulate the intermediate data stored in the database. The exploitation flow involves:

1. An authenticated attacker initiates a resumable layer upload to the Quay registry
2. The attacker identifies or manipulates the serialized upload state data
3. A crafted malicious serialized payload is injected into the upload state
4. When the upload is resumed or processed, the malicious payload is deserialized
5. The deserialization triggers arbitrary code execution on the Quay server

For detailed technical information, refer to the Red Hat CVE-2026-32590 advisory and Red Hat Bug Report #2446964.

Detection Methods for CVE-2026-32590

Indicators of Compromise

• Unusual or malformed container image layer upload requests in Quay logs
• Unexpected process spawning from the Quay application server
• Anomalous database modifications to upload state records
• Signs of lateral movement originating from the Quay server

Detection Strategies

• Monitor Quay application logs for suspicious upload patterns or errors during deserialization
• Implement runtime application security monitoring to detect unexpected code execution
• Review database audit logs for unauthorized modifications to upload state tables
• Deploy network intrusion detection rules for anomalous traffic patterns to/from the Quay server

Monitoring Recommendations

• Enable verbose logging for the container image upload functionality in Quay
• Configure alerts for failed or unusual upload resumption attempts
• Monitor system calls and process creation on Quay server hosts
• Implement file integrity monitoring on the Quay installation directory

How to Mitigate CVE-2026-32590

Immediate Actions Required

• Review Red Hat security advisories for available patches and apply them immediately
• Audit user accounts with upload permissions and restrict access where possible
• Implement network segmentation to limit access to the Quay server
• Enable additional logging and monitoring for the container registry

Patch Information

Consult the Red Hat CVE-2026-32590 security advisory for official patch information and updates. Organizations should prioritize applying vendor-provided patches as soon as they become available. Track the issue via Red Hat Bug Report #2446964 for the latest remediation guidance.

Workarounds

• Restrict network access to the Quay server using firewall rules to limit exposure
• Implement strict authentication controls and review user permissions for upload capabilities
• Consider temporarily disabling resumable uploads if operationally feasible until patches are applied
• Deploy a web application firewall (WAF) with rules to inspect and filter malicious upload payloads

Consult the Red Hat security advisory for specific configuration recommendations and temporary mitigations.