Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-18255

Quay: quay: global read-only superuser can view robot account tokens

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Quay 3.10

Default version status: affected

  • 1788561841 to < *unaffected

Red Hat Red Hat Quay 3.12

Default version status: affected

  • 1788594376 to < *unaffected

Red Hat Red Hat Quay 3.14

Default version status: affected

  • 1788593843 to < *unaffected

Red Hat Red Hat Quay 3.15

Default version status: affected

  • 1788191755 to < *unaffected

Red Hat Red Hat Quay 3.16

Default version status: affected

  • 1789563753 to < *unaffected

Red Hat Red Hat Quay 3.17

Default version status: affected

  • 1790690298 to < *unaffected

Red Hat Red Hat Quay 3.18

Default version status: affected

  • 1791265590 to < *unaffected

Red Hat Red Hat Quay 3.9

Default version status: affected

  • 1788595574 to < *unaffected

References