CVE-2026-18255

Summary

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Quay 3.101788561841 < *unaffected
Red HatRed Hat Quay 3.121788594376 < *unaffected
Red HatRed Hat Quay 3.151788191755 < *unaffected
Red HatRed Hat Quay 3.91788595574 < *unaffected

Weaknesses

  • CWE-863: Incorrect Authorization

Workarounds

Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References