CyberRota Analysis
AI-GeneratedAn authentication flaw in Quay allows an attacker to access auto-prune configurations from other namespaces, resulting in unauthorized information disclosure. This vulnerability arises from inadequate enforcement of namespace scoping during policy detail retrieval. Organizations using Quay should prioritize addressing this issue, especially those managing multiple repositories, to mitigate potential information leakage risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.