Flaw in Red Hat Quay Build Trigger Management API
CVE-2026-109194

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Quay 3
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109194?

A flaw exists in Red Hat Quay's build trigger management API, which lacks proper verification of whether a requested build trigger belongs to the specified repository. This issue allows authenticated users with administrative access to any repository to access, modify, or delete build triggers and their associated write tokens from other repositories, provided they know the universally unique identifier (UUID) of the target trigger.

References

https://access.redhat.com/security/cve/CVE-2026-109194
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2549645
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Xanlar Agamalizade for reporting this issue.
.