Security readout for executives and security teams
Plain-English summary
Quay can mistakenly make a user or robot an administrator of a repository created during a proxy-cache pull. That unintended access could allow repository changes and limited disclosure, creating container supply-chain risk. The issue matters primarily where organizations use Quay as a proxy cache and request images not yet mirrored.
Executive priority
Prioritize remediation for internet-accessible or broadly shared proxy-cache deployments because unintended repository administration can affect container integrity. Treat isolated deployments without proxy caching as lower urgency after confirming configuration. No supplied evidence supports emergency incident status, but potentially affected repositories should be reviewed promptly.
Technical view
When a proxy-cache organization handles the first pull of an unmirrored image, Quay creates a repository and incorrectly assigns Admin permission to the requester. The issue is classified as CWE-266 and CVSS 3.1 score 6.5, with network reachability, low complexity, no user interaction, and low confidentiality and integrity impact.
Likely exposure
Exposure requires a Quay deployment using an organization as a proxy cache. The vulnerable path is triggered when a user or robot pulls an image that has not already been mirrored. The bundle identifies multiple Red Hat Quay 3.13.6 and 3.14.2 package builds as affected; administrators should verify exact installed builds against vendor advisories.
Exploitation context
CISA KEV status is false, and the supplied sources do not report active exploitation or a public exploit. The CVSS vector rates the issue network-accessible and low complexity, but the available evidence does not establish practical exploitation prevalence or whether every deployment permits the relevant pull operation.
Researcher notes
The core authorization flaw occurs during first-time mirroring and incorrectly grants repository Admin rights. The supplied affected-product data lists Red Hat Quay 3 package builds, but its Project Quay version entries are ambiguous and default to unaffected. Researchers should rely on vendor build mappings and avoid generalizing the affected range beyond documented packages.
Mitigation direction
- Check installed Quay packages and versions against the linked Red Hat advisories.
- Apply vendor-provided corrected updates where the advisories identify them for your deployment.
- Restrict proxy-cache access to trusted users and robots until remediation is confirmed.
- Review and remove unintended Admin assignments on proxy-created repositories.
Validation and detection
- Inventory organizations configured as proxy caches and their deployed Quay package builds.
- Review newly mirrored repositories for unexpected user or robot Admin permissions.
- After updating, safely test first-pull repository creation in a non-production environment.
- Confirm requesters receive only the permissions intended by organizational policy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-4374 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5redhatVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHBA-2025:8262CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHBA-2025:8263CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHBA-2025:8687CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHBA-2025:8688CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-4374CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2364267CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.