RHSA-2026:81110 - Security Advisory

Topic

A new version of Red Hat Quay is now available.

Description

Red Hat Quay

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Affected Products

• Red Hat Quay

Fixes

• BZ - 2487946
• BZ - 2497452
• BZ - 2497455
• BZ - 2500022
• BZ - 2500041
• BZ - 2500043
• BZ - 2500052
• BZ - 2500057
• BZ - 2500060
• BZ - 2500061
• BZ - 2500752
• BZ - 2502307
• BZ - 2503746
• BZ - 2508411
• BZ - 2508454
• BZ - 2509993
• BZ - 2510011
• BZ - 2510017
• BZ - 2510030
• BZ - 2520368
• BZ - 2520616
• PROJQUAY-10068 - Proxying of manifests containing multiple same child manifests fails on Quay
• PROJQUAY-11619 - Redact LDAP passwords when USERS_DEBUG=1 is enabled
• PROJQUAY-11682 - Autopruner matching on .sig tags instead of filtering them
• PROJQUAY-12226 - [New UI]: Missing repository name in breadcrumb when tag name same with repo name
• PROJQUAY-12236 - Quay 3.18.0 Namespace Notifications table truncates Title and Status column headers
• PROJQUAY-12351 - Global readonly superuser blocked from reading namespace notifications (GET endpoints)
• PROJQUAY-12361 - Quay nginx config includes TLS 1.2 ciphers when cluster TLS profile is set to Modern (TLS 1.3 only)
• PROJQUAY-12364 - Quay nginx config includes TLS 1.2 ciphers when cluster TLS profile is set to Modern (TLS 1.3 only)
• PROJQUAY-12366 - Quay Audit log shows 'No description available' for namespace notification actions
• PROJQUAY-12368 - Quota enforcement: rejected blob uploads leave orphaned BlobUpload rows that permanently block subsequent pushes
• PROJQUAY-12375 - Quay 3.18 Slack quota notifications have broken bold formatting and missing usage data
• PROJQUAY-12386 - V2 UI routing bug: malformed API requests when organization name contains the "organization" word
• PROJQUAY-12411 - Repository mirroring does not work on 3.17.x when both source and destination are the same registry
• PROJQUAY-12551 - Autopruner matching on .sig tags instead of filtering them
• PROJQUAY-12639 - feat(ui): display nightly build info in Quay new UI help dropdown
• PROJQUAY-12791 - Clean up orphaned multipart uploads as part of blob cleanup work
• PROJQUAY-12814 - Limit Clair scanning of images to at most n attempts
• PROJQUAY-13133 - Excessive DNS query bursts from Quay v3.18 causing local resolver saturation
• PROJQUAY-13194 - Quay UI does not display shield icon for images signed with cosign
• PROJQUAY-13200 - Redact LDAP passwords when USERS_DEBUG=1 is enabled
• PROJQUAY-13273 - test(playwright): superuser fixtures outlive FRESH_LOGIN_TIMEOUT and fail with 401 fresh_login_required
• PROJQUAY-13315 - test(playwright): superuser fixtures outlive FRESH_LOGIN_TIMEOUT and fail with 401 fresh_login_required
• PROJQUAY-13316 - test(playwright): stabilize label commit and pin manifest-list fixture
• PROJQUAY-13331 - Referrers cache not invalidated on manifest push causing stale referrers list
• PROJQUAY-13333 - Quota enforcement: rejected blob uploads leave orphaned BlobUpload rows that permanently block subsequent pushes
• PROJQUAY-13339 - Proxying of manifests containing multiple same child manifests fails on Quay
• PROJQUAY-13341 - Fix nested indexes in quay
• PROJQUAY-13342 - Repo mirror SSRF requires pod-local DNS and breaks disconnected installs that use HTTPS_PROXY
• PROJQUAY-13365 - Increase blob/temp tag expiry
• PROJQUAY-13367 - Do not run expensive quota checks when not needed
• PROJQUAY-13373 - Get a unexpected danger alert in the new UI when use a email address to create notification in a repository for the first time
• PROJQUAY-13374 - Quay 3.10 new UI should validate the input tag name when create new tag
• PROJQUAY-13375 - Can't get error notification when input invalid robot account description in new UI
• PROJQUAY-13385 - Registry blob commit blocks ~25-60s on BLOB_DELETE GlobalLock contention (double blocking acquire in with_blob_lock_or_fallback)
• PROJQUAY-13417 - 'quota update error, Unauthorized' when changing organization quota limit using v2 UI
• PROJQUAY-13509 - Archived build logs return 500 on GCS storage: zlib "incorrect header check" when GCS serves an already-decoded object
• PROJQUAY-13511 - Authentication timeouts with OIDC backend in large environments
• PROJQUAY-8272 - Fix nested indexes in quay

CVEs

• CVE-2026-15792
• CVE-2026-16221
• CVE-2026-18255
• CVE-2026-44705
• CVE-2026-49477
• CVE-2026-49825
• CVE-2026-54058
• CVE-2026-54770
• CVE-2026-55379
• CVE-2026-55380
• CVE-2026-59197
• CVE-2026-59199
• CVE-2026-59200
• CVE-2026-59204
• CVE-2026-59205
• CVE-2026-59886
• CVE-2026-67214
• CVE-2026-67313
• CVE-2026-67314
• CVE-2026-67320
• CVE-2026-67321

References

• https://access.redhat.com/security/updates/classification/