Description
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Project Quay | quay | < 3.9.28, 3.10.0 – < 3.10.28, 3.12.0 – < 3.12.24, 3.14.0 – < 3.14.10, 3.15.0 – < 3.15.9, 3.16.0 – < 3.16.7, 3.17.0 – < 3.17.7, 3.18.0 – < 3.18.3 | 3.9.28 |
| Red Hat | Red Hat Quay 3.10 | — | — |
| Red Hat | Red Hat Quay 3.12 | — | — |
| Red Hat | Red Hat Quay 3.14 | — | — |
| Red Hat | Red Hat Quay 3.15 | — | — |
| Red Hat | Red Hat Quay 3.16 | — | — |
| Red Hat | Red Hat Quay 3.17 | — | — |
| Red Hat | Red Hat Quay 3.18 | — | — |
| Red Hat | Red Hat Quay 3.9 | — | — |
| Red Hat | Red Hat OpenShift Update Service | — | — |
| Red Hat | Red Hat Quay 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dataquay | No fix yet | — |
| Ubuntu 26.04 LTS | dataquay | No fix yet | — |
| Ubuntu 24.04 LTS | dataquay | No fix yet | — |
| Ubuntu 22.04 LTS | dataquay | No fix yet | — |
| Ubuntu 20.04 LTS | dataquay | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | dataquay | No fix yet | — |
| Ubuntu 16.04 LTS | dataquay | No fix yet | — |
References
- RHSA-2026:99019 vendor-advisory
- RHSA-2026:99021 vendor-advisory
- RHSA-2026:99022 vendor-advisory
- RHSA-2026:99023 vendor-advisory
- RHSA-2026:99024 vendor-advisory
- RHSA-2026:99025 vendor-advisory
- RHSA-2026:99026 vendor-advisory
- RHSA-2026:99027 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-110697 vdb-entry
- https://access.redhat.com/solutions/7149592
- RHBZ#2552237 issue-tracking