Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry

A critical vulnerability in Red Hat Quay allows attackers to access and modify private container images across all repositories in a registry. This can be done by anyone who can access the Quay registry, with or without an account, depending on the registry's anonymous access settings. By default, Quay enables anonymous access, allowing attackers to exploit the flaw without needing an account. If anonymous access is disabled, attackers can still exploit the vulnerability using a valid account. Red Hat has issued fixed builds for eight Quay versions to address the issue. The flaw poses a significant risk to the security of private container images stored in Quay registries.