ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109195

A flaw was found in Quay.

Published Oct 12, 2026 · updated Oct 15, 2026

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sh

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sh

  3. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sh

Sources

  • CVE.orgVulnerability recordCVE-2026-109195

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-109195

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-109195

    A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy

    nvd.nist.gov

References