CVE-2026-18255

Summary

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Affected Software

Weaknesses

• CWE-863: Incorrect Authorization

Workarounds

Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://access.redhat.com/security/cve/CVE-2026-18255
• https://bugzilla.redhat.com/show_bug.cgi?id=2508454

• ←Previous
• Next→