CVE-2026-109194

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

CVE-2026-109194

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

CVE-2026-109194 Quay: build trigger uuid idor in quay api

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

CVE-2026-109194

A flaw in Red Hat Quay allows an authenticated user with administrative access to any repository to perform an Insecure Direct Object Reference (IDOR) attack. The build trigger management API fails to verify if a requested trigger belongs to the specified repository. By knowing the universally un...

EUVD-2026-97498

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

PT-2026-110637

🚨 CVE-2026-109194 A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanent...

CVE-2026-109194: Authorization Bypass Through User-Controlled Key

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2026-106121 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-106121 Source advisory:...

com.github.pukkaone:logback-gelf (>=1.1.5, <=1.1.9), com.globo.graylog2:gelfj (>=1.1.16.0, <=1.1.16.1) +13 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.0.4)

com.rabbitmq:amqp-client MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.pukkaone:logback-gelf =1.1.5, =1.1.16.0, =2.0.0, =1.1.3, =1.2, =1.2, =1.5 Source cves: CVE-2026-1061...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2026-106122 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-106122 Source advisory:...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2026-106123 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-106123 Source advisory:...

CVE-2026-105447

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...

CVE-2026-105447 Quay: quay: global read-only superuser can access build trigger write credentials

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...

EUVD-2026-92793

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...

CVE-2026-105447

A flaw in Quay incorrectly exposes build trigger configuration details , which include repository write tokens, to global read-only administrative users during build trigger requests. An authenticated user with read-only privileges can exploit this by querying the build trigger API to retrieve th...

CVE-2026-105447 Quay: quay: global read-only superuser can access build trigger write credentials

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...

CVE-2026-105447

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...