CVE-2026-109195 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Quay 3 deployments should assess exposure and prioritize verifying and restricting access to repository auto-prune configurations. They should ensure proper namespace scoping for policy details retrieval and monitor for suspicious activity related to repository auto-prune configurations. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-109195 is a vulnerability in Red Hat Quay 3 that allows authenticated attackers to access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. Defenders should prioritize verifying and restricting access to repository auto-prune configurations, ensuring proper namespace scoping, and monitoring for suspicious activity.

• Verify and restrict access to repository auto-prune configurations to prevent unauthorized information disclosure
• Ensure proper namespace scoping for policy details retrieval to prevent unauthorized access
• Monitor for suspicious activity related to repository auto-prune configurations to detect potential attacks

Technical summary

The vulnerability occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue has a CVSS score of 3.1 and is considered low severity. The vulnerability impacts Red Hat Quay 3 deployments, and defenders should prioritize verifying and restricting access to repository auto-prune configurations.

Defensive priority

Defenders should prioritize verifying and restricting access to repository auto-prune configurations, ensuring proper namespace scoping, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and restrict access to repository auto-prune configurations
• Ensure proper namespace scoping for policy details retrieval
• Monitor for suspicious activity related to repository auto-prune configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The source item provides additional metadata about the vulnerability. The CVE record was published on 2026-10-12T15:27:03.366Z and has not been modified since then. The source item provides additional metadata about the vulnerability, but its description and summary are null.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.