Red Hat Quay 3.16.6 Addresses 42 Vulnerabilities
Tech GuruQuick Answer
Red Hat released Quay 3.16.6 under RHSA-2026:69255, addressing the 42 listed CVEs in the 3.16 stream. Alongside dependency fixes, the advisory includes repository-mirror request validation and robot-token access by a global read-only superuser. These privileges and features matter when assessing local exposure.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Red Hat Quay 3.16, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Quay 3.16 |
|---|---|
| Advisory | RHSA-2026:69255 |
| CVEs | CVE-2026-13149, CVE-2026-15792, CVE-2026-15927, CVE-2026-16221, CVE-2026-18255, CVE-2026-32283, CVE-2026-33818, CVE-2026-39822, CVE-2026-44705, CVE-2026-49477, CVE-2026-54058, CVE-2026-54060, CVE-2026-54770, CVE-2026-55379, CVE-2026-55380, CVE-2026-56852, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-57231, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205, CVE-2026-59869, CVE-2026-59879, CVE-2026-59885, CVE-2026-59886, CVE-2026-67213, CVE-2026-67214, CVE-2026-67313, CVE-2026-67314, CVE-2026-67320, CVE-2026-67321, CVE-2026-69152, CVE-2026-73086, CVE-2026-75593, CVE-2026-82417, CVE-2026-84375 |
| Authoritative release date | 2026-09-21 08:25:12 UTC |
| Authority revision date | 2026-09-21 11:53:24 UTC |
| Affected versions | The advisory-specific supported Red Hat Quay 3.16 builds before the listed fixed package or release. |
| Fixed version | Red Hat Quay 3.16.6 |
| CVSS base score | 5.3 / 6.5 / 6.8 / 7.2 / 7.4 / 7.5 / 7.8 / 8.1 / 8.2 / 9.1 (CVSS v3.1) |
| CVSS severity | Medium to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-15927 allows an authenticated repository administrator to supply an unchecked mirror reference that makes the mirror worker request internal services or cloud metadata. CVE-2026-18255 lets a user in GLOBAL_READONLY_SUPER_USERS view robot tokens for repositories they do not belong to and impersonate those accounts. Neither description is an unauthenticated registry-wide token dump. The remaining listed issues cover bundled components and have their own conditions.
What To Validate Now
- Inventory. Locate Red Hat Quay 3.16 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The advisory-specific supported Red Hat Quay 3.16 builds before the listed fixed package or release. Do not infer applicability from product family or severity alone.
- Remediate. Apply Red Hat Quay 3.16.6 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Verify the deployed Quay release and test approved image push/pull, authentication, robot-account access controls, and repository mirroring. Include expected authorization denials and mirror destinations, not only a healthy registry response.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve mirror configuration, relevant administrator activity, and robot-token access evidence if exposure is suspected. The fixed release prevents the described flaws going forward but does not revoke tokens already disclosed; handle any credential response through the evidence-based incident process.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
