CVE-2026-6848

OVERVIEW CVE-2026-6848 is an authentication bypass vulnerability affecting Red Hat Quay that allows attackers to circumvent password re-verification requirements for sensitive operations including token generation and robot account creation. The flaw enables users with expired sessions or attackers with access to idle authenticated browser sessions to perform privileged actions without providing valid credentials, despite the system displaying authentication error messages to users. SEVERITY This vulnerability carries a CVSS 3.1 score of 5.4 (MEDIUM) with a network attack vector, low attack complexity, and low privilege requirements. The impact is limited to low-level confidentiality and integrity compromise with no availability impact. The EPSS score of 0.0005 indicates this vulnerability has received minimal community attention relative to other published CVEs, though the FAUCET Risk Score of 41.0/100 suggests moderate organizational risk depending on deployment scope and sensitivity of protected operations. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not present on the CISA Known Exploited Vulnerabilities list and remains classified as inactive on threat tracking platforms. No public exploit code is currently available, and community engagement appears limited given the low EPSS percentile ranking. Organizations running Red Hat Quay should implement available patches when released, though the moderate risk profile does not suggest immediate emergency response protocols are required.