Red Hat Quay CVE-2026-32590: Brief Summary of Pickle Deserialization in Resumable Uploads

Introduction

A deserialization flaw in Red Hat Quay's resumable upload mechanism means that tampered intermediate upload data stored in the database can lead to arbitrary code execution on the registry server. Many organizations use Quay as the central container image registry for their OpenShift clusters, particularly in disconnected environments. For them, this vulnerability (CVE-2026-32590, CVSS 7.1) is a direct supply chain risk to every downstream deployment that pulls images from a compromised registry.

Red Hat Quay is a distributed, highly available container image registry designed for secure storage, distribution, and governance of containers and cloud-native artifacts. It is widely deployed in enterprise environments and is the default mirror registry for OpenShift Container Platform clusters that run without internet connectivity. Because Quay sits at the center of the container delivery pipeline, code execution on the registry server matters well beyond that one host.

Technical information

The vulnerability is in Quay's resumable upload feature for container image layers. When a user or automated system uploads an image layer in chunks, Quay stores the intermediate state of the upload in its database. The Bugzilla entry (bug 2446964) identifies the root cause as pickle deserialization. Quay serializes the intermediate upload data in Python's pickle format, and when the upload resumes, the application deserializes that data without adequate validation.

Python's pickle module is unsafe to use on untrusted data. During deserialization, pickle can instantiate arbitrary Python objects and invoke their constructors or special methods such as __reduce__. An attacker who can inject a crafted pickle payload into the stored intermediate upload state can make Quay execute arbitrary code when it deserializes that data on the next resumption step.

The flaw is a clear case of CWE-502 (Deserialization of Untrusted Data), where an application deserializes data from a source without sufficiently verifying that the result will be valid and safe. Deserialization converts packaged data back into internal program objects. When an adversary injects malicious content into those serialized objects, the application blindly instantiates them.

Attack flow

Exploitation follows these steps:

1. An attacker initiates or identifies a resumable image layer upload to the Quay registry.
2. The attacker finds a way to modify the intermediate upload state stored in the Quay database. Current public advisories do not fully detail what this step requires, whether direct database access, SQL injection, or some other vector.
3. The attacker replaces the legitimate serialized intermediate data with a malicious pickle payload crafted to execute arbitrary commands on deserialization.
4. When the upload resumes and Quay reads the intermediate state from the database, the application deserializes the tampered pickle data.
5. The payload executes with the privileges of the Quay application process, and the attacker has code execution on the registry server.

Supply chain implications

Quay is the authoritative source for container images across an organization's infrastructure. An attacker with code execution on the registry could taint container images, inject backdoors into base images, or pivot to compromise downstream OpenShift clusters that pull images from it. One compromised server becomes a broad supply chain attack on every environment that trusts the registry.

Affected systems and versions

The public advisories for CVE-2026-32590 do not currently list which Red Hat Quay versions are affected. Given where the flaw sits (pickle deserialization in the resumable upload path), any version of Red Hat Quay whose upload mechanism uses pickle to serialize intermediate state is potentially affected.

Red Hat currently maintains the following active Quay release streams:

Organizations should monitor Red Hat security bulletins for official confirmation of which versions contain the fix.

Vendor security history

Red Hat patches the Quay product line actively and responsively, and recent advisories show ongoing maintenance across several release streams. Version 3.15.4 shipped bug fixes and security updates (RHSA-2026:6568). Version 3.16.3 addressed critical-severity vulnerabilities (RHSA-2026:6567). Version 3.17.0 introduced Clair 4.9 and default container security hardening, including a DROP ALL Linux capabilities strategy and hardened seccomp profiles.

References

• CVE-2026-32590 at Red Hat Security
• Bugzilla 2446964: CVE-2026-32590 mirror-registry: remote code execution using pickle deserialization
• CWE-502: Deserialization of Untrusted Data
• Red Hat Quay Architecture Overview
• Red Hat Quay 3.17 Release Notes
• RHSA-2026:6568 Security Advisory
• RHSA-2026:6567 Vulnerability Intelligence
• Best Practices: Unsafe Deserialization of Untrusted Data
• Resolving Deserialization of Untrusted Data (CWE ID 502)