CVE-2026-105447 Red Hat CVE debrief

Who should care

Red Hat Quay 3 administrators and security teams should assess exposure and prioritize remediation. They should verify inventory, review compensating controls, and monitor for potential exploitation attempts. Security teams need to track exceptions, retest remediated assets, and ensure evidence is documented before closing the item. This involves confirming whether affected product deployments exist in managed environments and assigning an owner for follow

Why it matters

CVE-2026-105447 allows global read-only superusers to access build trigger write credentials in Quay, potentially leading to privilege escalation and bypass of read-only limitations. Red Hat Quay 3 administrators and security teams should assess exposure, verify inventory, and prioritize remediation.

• Privilege escalation for global read-only superusers
• Potential push of arbitrary container images to private repositories
• Bypass of read-only limitations
• Verification of inventory and remediation priority

Technical summary

CVE-2026-105447 is a flaw in Quay that exposes build trigger write credentials to global read-only superusers, potentially leading to privilege escalation and bypass of read-only limitations. The vulnerability allows authenticated users with read-only privileges to exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue affects Red Hat Quay 3 deployments, which should be assessed for exposure and prioritized for remediation based on official CVE and NVD details. The flaw is related to incorrect exposure of trigger configuration details containing repository write tokens.

Defensive priority

Assess exposure, verify inventory, and prioritize remediation for Red Hat Quay 3 deployments

Recommended defensive actions

• Assess exposure of Red Hat Quay 3 deployments to CVE-2026-105447
• Verify inventory of affected Red Hat Quay 3 instances
• Prioritize remediation for exposed Red Hat Quay 3 deployments
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NIST NVD detail page provide vulnerability metadata and assessment. The CVE record was published on 2026-10-05T20:29:45.881Z and has not been modified since then. Evidence is limited to supplied source corpus and CVE details. Defenders should verify inventory, assess exposure, and prioritize remediation for Red Hat Quay 3 deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.