Description
A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Quay 3.10 | — | — |
| Red Hat | Red Hat Quay 3.12 | — | — |
| Red Hat | Red Hat Quay 3.14 | — | — |
| Red Hat | Red Hat Quay 3.15 | — | — |
| Red Hat | Red Hat Quay 3.16 | — | — |
| Red Hat | Red Hat Quay 3.17 | — | — |
| Red Hat | Red Hat Quay 3.18 | — | — |
| Red Hat | Red Hat Quay 3.9 | — | — |
Advisories 1
- WID-SEC-2026-2576 Red Hat Quay: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 12, 2026
References
- RHSA-2026:63307 vendor-advisory
- RHSA-2026:65514 vendor-advisory
- RHSA-2026:66084 vendor-advisory
- RHSA-2026:66523 vendor-advisory
- RHSA-2026:69255 vendor-advisory
- RHSA-2026:70267 vendor-advisory
- RHSA-2026:74511 vendor-advisory
- RHSA-2026:81110 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-18255 vdb-entry
- RHBZ#2508454 issue-tracking