RHSA-2026:48085 - Security Advisory

Topic

Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.

Description

Quay 3.18.0

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Quay

Fixes

• https://redhat.atlassian.net/browse/PROJQUAY-10282 - [Workers] Repository Mirror Metrics and Health Monitoring
• https://redhat.atlassian.net/browse/PROJQUAY-10504 - Immutability bypass: Manifest deletion by digest skips immutable tags instead of blocking
• https://redhat.atlassian.net/browse/PROJQUAY-10524 - Copy-to-clipboard shortcuts for tag name and digests
• https://redhat.atlassian.net/browse/PROJQUAY-10538 - Microsoft Entra v2 Token Support
• https://redhat.atlassian.net/browse/PROJQUAY-10575 - Cancel Repository Mirroring log: null Not applicable Not applicable
• https://redhat.atlassian.net/browse/PROJQUAY-10605 - Duplicate namespace info in "Repository" field in Usage log
• https://redhat.atlassian.net/browse/PROJQUAY-10631 - Quay operator supports certmanager
• https://redhat.atlassian.net/browse/PROJQUAY-10703 - [Operator] OpenShift TLS Security Profile Integration
• https://redhat.atlassian.net/browse/PROJQUAY-10705 - [Operator] Inherit cluster TLS security profile for Quay and Mirror
• https://redhat.atlassian.net/browse/PROJQUAY-10707 - [Operator] External TLS Secret Reference Support
• https://redhat.atlassian.net/browse/PROJQUAY-10724 - [Operator] Replace blocking poll in Job reconciliation with requeue pattern
• https://redhat.atlassian.net/browse/PROJQUAY-10725 - [Operator] Replace per-reconcile Route probe with cached discovery
• https://redhat.atlassian.net/browse/PROJQUAY-10730 - Redis component resource overrides
• https://redhat.atlassian.net/browse/PROJQUAY-10795 - "Load More Logs" button splashing during loading Usage Logs
• https://redhat.atlassian.net/browse/PROJQUAY-10798 - Cancel a organization mirror process will trigger an endless stream of log "Organization mirror sync failed - Sync cancelled:"
• https://redhat.atlassian.net/browse/PROJQUAY-10845 - Ensure that we don't send artifacts for scanning
• https://redhat.atlassian.net/browse/PROJQUAY-10884 - Migrate to PatternFly6
• https://redhat.atlassian.net/browse/PROJQUAY-10934 - Repository cache invalidation is not occurring on repo deletion
• https://redhat.atlassian.net/browse/PROJQUAY-11025 - Org mirror Schedule/Pending State doesn't consistent with following dropdown list
• https://redhat.atlassian.net/browse/PROJQUAY-11027 - Org mirror "Cancel Sync" clean the "Next Sync Date" value
• https://redhat.atlassian.net/browse/PROJQUAY-11077 - Improper redirection on OIDC login when Quay is exposed via non-standard HTTP/HTTPS ports
• https://redhat.atlassian.net/browse/PROJQUAY-11079 - Quay 3.17 New UI change_tag_immutability action missing from usage logs chart
• https://redhat.atlassian.net/browse/PROJQUAY-11119 - Organization Proxy Cache doesn't work when not set FEATURE_IMMUTABLE_TAGS
• https://redhat.atlassian.net/browse/PROJQUAY-11158 - The "Auto-Prune Policies" tab has disappeared in user name organization
• https://redhat.atlassian.net/browse/PROJQUAY-11212 - Support annotation and label passthrough on managed OpenShift Routes
• https://redhat.atlassian.net/browse/PROJQUAY-11217 - Searching for a non-existent repository will permanently display a circular loading spinner on the page
• https://redhat.atlassian.net/browse/PROJQUAY-11218 - Click one permission in the permission dropdown list will go to "This site is temporarily unavailable" page in Firefox
• https://redhat.atlassian.net/browse/PROJQUAY-11219 - The string entered in the repository filter will automatically be displayed in unreasonable places
• https://redhat.atlassian.net/browse/PROJQUAY-11257 - Quay new UI Login page branding logo is invisible
• https://redhat.atlassian.net/browse/PROJQUAY-11288 - nginx returns a 404 http code instead of 502 due to missing 502.html page
• https://redhat.atlassian.net/browse/PROJQUAY-11314 - quay mirror registry should fail to install when hostname does not meet DNS requirements
• https://redhat.atlassian.net/browse/PROJQUAY-11319 - Quay OCI image with no history causes AttributeError in get_layers(), manifest API returns 404
• https://redhat.atlassian.net/browse/PROJQUAY-11331 - config-tool: malformed struct tag on DistributedStorageArgs.Signature breaks storage config serialization
• https://redhat.atlassian.net/browse/PROJQUAY-11347 - Repo Mirror tag pattern change requires re-entering credentials for private repos
• https://redhat.atlassian.net/browse/PROJQUAY-11373 - Surface metrics for pilot program tracking
• https://redhat.atlassian.net/browse/PROJQUAY-11382 - Deleting org mirror config leaves repositories stuck in ORG_MIRROR state
• https://redhat.atlassian.net/browse/PROJQUAY-11394 - Quay UI appears sparse for Gemara OCI artifacts
• https://redhat.atlassian.net/browse/PROJQUAY-11403 - Quay new UI: manifest track vertical line appears on pages where no tags share the same digest
• https://redhat.atlassian.net/browse/PROJQUAY-11433 - perf(db): slow repository UPDATE queries during namespace deletion (14s+)
• https://redhat.atlassian.net/browse/PROJQUAY-11461 - Harden GitHub Actions security across all workflows
• https://redhat.atlassian.net/browse/PROJQUAY-11475 - Migrate web frontend from npm to pnpm
• https://redhat.atlassian.net/browse/PROJQUAY-11478 - UI disallows creation of proxy configuration even if organization mirroring is turned off
• https://redhat.atlassian.net/browse/PROJQUAY-11486 - quay validator does not properly validate s3 URL
• https://redhat.atlassian.net/browse/PROJQUAY-11501 - Quay 3.18 Operator rejects "PULL_METRICS_REDIS" in configBundleSecret when Redis is managed after config-tool migration
• https://redhat.atlassian.net/browse/PROJQUAY-11515 - Proxy Cache creation not blocked by API when organization is in Org Mirror state
• https://redhat.atlassian.net/browse/PROJQUAY-11524 - [3.18] Race condition during initial database setup
• https://redhat.atlassian.net/browse/PROJQUAY-11549 - Quay 3.18 External TLS secretRef missing SERVER_HOSTNAME certificate validation
• https://redhat.atlassian.net/browse/PROJQUAY-11556 - Implement volumeSize and storageClassName overrides for Clair ephemeral volume
• https://redhat.atlassian.net/browse/PROJQUAY-11576 - feat(ldap): add queue-based admin connection pool to eliminate per-request TCP/TLS/bind overhead
• https://redhat.atlassian.net/browse/PROJQUAY-11577 - Quay New UI Usage Logs chart legend overlaps chart area making both unreadable
• https://redhat.atlassian.net/browse/PROJQUAY-11637 - Lazy load of OCI indexes does not tolerate Docker v2 schema 2 images in the index
• https://redhat.atlassian.net/browse/PROJQUAY-11661 - Optimize GC queries
• https://redhat.atlassian.net/browse/PROJQUAY-11678 - Quay New UI: Superuser Build Logs page returns 500 error due to BuildTrigger.to_dict() logic bug
• https://redhat.atlassian.net/browse/PROJQUAY-11684 - quay-operator: add local development setup with KinD
• https://redhat.atlassian.net/browse/PROJQUAY-11691 - Optimize UI loading
• https://redhat.atlassian.net/browse/PROJQUAY-11798 - feat(oidc): Multi-issuer and multi-audience support for Microsoft Entra v2 tokens
• https://redhat.atlassian.net/browse/PROJQUAY-11851 - Quay 3.18 Operator: RBAC denial on apiservers.config.openshift.io blocks entire Quay deployment
• https://redhat.atlassian.net/browse/PROJQUAY-11889 - Quay New UI: Global sidebar shown on repository detail pages reduces content area width
• https://redhat.atlassian.net/browse/PROJQUAY-11890 - Organization Mirror Repository Metrics and Health Monitoring
• https://redhat.atlassian.net/browse/PROJQUAY-11892 - [Quay-3.18.0-rc] Repo mirror metrics are not available in the Monitoring Metrics in the OCP webconsole
• https://redhat.atlassian.net/browse/PROJQUAY-11930 - Quay 3.18.0 New UI: Superuser Build Logs page shows 'No logs available' for archived builds
• https://redhat.atlassian.net/browse/PROJQUAY-11931 - Quay 3.18.0 New UI: Superuser Change Log page shows stale v3.11.0 content instead of current release
• https://redhat.atlassian.net/browse/PROJQUAY-11952 - Quay ignoring session timeouts
• https://redhat.atlassian.net/browse/PROJQUAY-12004 - Quay 3.18.0 Red Hat ACS reports high image vulnerabilities for Quay Postgres and Redis components
• https://redhat.atlassian.net/browse/PROJQUAY-12005 - Quay 3.18.0 Mirror health API returns stale data: workers.active, tags_pending, last_sync always zero/null
• https://redhat.atlassian.net/browse/PROJQUAY-12151 - fix(ui): wizard panel overflows modal in Create Robot Account / Create Team / Build Trigger wizards
• https://redhat.atlassian.net/browse/PROJQUAY-12197 - [3.18] - quay 3.17.0 clair can't pull the upstream vulnerability database
• https://redhat.atlassian.net/browse/PROJQUAY-12221 - Quay Superuser Change Log page shows Error Loading Change Log (502) due to missing CHANGELOG.md in container image
• https://redhat.atlassian.net/browse/PROJQUAY-12229 - Quay 3.18.0 Namespace Notifications table truncates Title and Status column headers
• https://redhat.atlassian.net/browse/PROJQUAY-12230 - Quay Quota notifications fail with TypeError: Decimal is not JSON serializable
• https://redhat.atlassian.net/browse/PROJQUAY-12232 - Quay Audit log shows 'No description available' for namespace notification actions
• https://redhat.atlassian.net/browse/PROJQUAY-12233 - Global readonly superuser blocked from reading namespace notifications (GET endpoints)
• https://redhat.atlassian.net/browse/PROJQUAY-12322 - Quay 3.18.0 operator Modern TLS profile causes nginx crash: TLS 1.3 ciphers passed to ssl_ciphers directive
• https://redhat.atlassian.net/browse/PROJQUAY-12369 - Quay 3.18 Slack quota notifications have broken bold formatting and missing usage data
• https://redhat.atlassian.net/browse/PROJQUAY-12398 - Quay Operator 3.18: fixable Important CVEs in managed component images (clair-postgres, quay-database, redis)
• https://redhat.atlassian.net/browse/PROJQUAY-5075 - Don't fail startup validation when a non-preferred storage engine is not available
• https://redhat.atlassian.net/browse/PROJQUAY-5657 - Quay ignoring session timeouts
• https://redhat.atlassian.net/browse/PROJQUAY-6684 - Quay operator can configure temp storage for Clair
• https://redhat.atlassian.net/browse/PROJQUAY-6975 - Allow a single email address to be used for multiple orgs
• https://redhat.atlassian.net/browse/PROJQUAY-7306 - The ability for High Quota warning be able to be sent via email, Slack webhooks, etc. 
• https://redhat.atlassian.net/browse/PROJQUAY-8440 - Pulling of cached image from Quay requires upstream registry availability
• https://redhat.atlassian.net/browse/PROJQUAY-9157 - MountVolume.SetUp failed for volume "config"
• https://redhat.atlassian.net/browse/PROJQUAY-9246 - Quay new UI can't select all Oauth applications
• https://redhat.atlassian.net/browse/PROJQUAY-9256 - The default value of `Skopeo timeout interval` field can't be cleared and a new value entered
• https://redhat.atlassian.net/browse/PROJQUAY-9695 - logrotateworker isn't working after the update to 3.15
• https://redhat.atlassian.net/browse/PROJQUAY-9883 - The filter in super user Service Keys panel does not work

CVEs

• CVE-2026-27459
• CVE-2026-27962
• CVE-2026-29074
• CVE-2026-32590
• CVE-2026-32591
• CVE-2026-34986
• CVE-2026-42039
• CVE-2026-4427
• CVE-2026-48526

References

• https://access.redhat.com/security/updates/classification/