CVE-2026-32590

CVE-2026-32590 is a vulnerability in Red Hat Quay's resumable container image layer upload functionality that allows attackers to execute arbitrary code on affected servers through tampering with intermediate upload data stored in the database. The flaw affects Red Hat Quay and requires authentication to exploit, making it a privilege escalation risk for authenticated users with upload capabilities. The vulnerability carries a CVSS score of 8.8 (High) with network accessibility and low attack complexity, indicating that remote exploitation is straightforward once authenticated. The attack provides complete compromise of confidentiality, integrity, and availability on the affected Quay server. The EPSS score of 0.00081 suggests this vulnerability poses a lower relative risk compared to the broader CVE landscape. There is currently no evidence of active exploitation in the wild, as indicated by its absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The FAUCET Risk Score of 42.0 reflects moderate concern, though the low EPSS score and lack of public exploit code suggest limited immediate threat. Organizations running Red Hat Quay should prioritize patching based on environmental risk rather than imminent threat activity.