CVE-2026-128824
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.