Quay: quay: global read-only superuser can view robot account tokens
Priority LOW 35CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00771 55th percentileScored 2026-11-07
Fix Fixed Red Hat: 8 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Quay 3.10 | — | 1788561841 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.12 | — | 1788594376 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.14 | — | 1788593843 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.15 | — | 1788191755 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.16 | — | 1789563753 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.17 | — | 1790690298 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.18 | — | 1791265590 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.9 | — | 1788595574 | Patch available | CNA |
- Red Hat Quay 3.10 VendorRed Hat Affected — Fixed in 1788561841 Patch available CNA
- Red Hat Quay 3.12 VendorRed Hat Affected — Fixed in 1788594376 Patch available CNA
- Red Hat Quay 3.14 VendorRed Hat Affected — Fixed in 1788593843 Patch available CNA
- Red Hat Quay 3.15 VendorRed Hat Affected — Fixed in 1788191755 Patch available CNA
- Red Hat Quay 3.16 VendorRed Hat Affected — Fixed in 1789563753 Patch available CNA
- Red Hat Quay 3.17 VendorRed Hat Affected — Fixed in 1790690298 Patch available CNA
- Red Hat Quay 3.18 VendorRed Hat Affected — Fixed in 1791265590 Patch available CNA
- Red Hat Quay 3.9 VendorRed Hat Affected — Fixed in 1788595574 Patch available CNA
CPE names CNA · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:quay:3.10::el8 | 3.10 | — | Red Hat |
| cpe:/a:redhat:quay:3.12::el8 | 3.12 | — | Red Hat |
| cpe:/a:redhat:quay:3.14::el8 | 3.14 | — | Red Hat |
| cpe:/a:redhat:quay:3.15::el8 | 3.15 | — | Red Hat |
| cpe:/a:redhat:quay:3.16::el9 | 3.16 | — | Red Hat |
| cpe:/a:redhat:quay:3.17::el9 | 3.17 | — | Red Hat |
| cpe:/a:redhat:quay:3.18::el9 | 3.18 | — | Red Hat |
| cpe:/a:redhat:quay:3.9::el8 | 3.9 | — | Red Hat |
- cpe:/a:redhat:quay:3.10::el8 Versions 3.10 — ·Red Hat
- cpe:/a:redhat:quay:3.12::el8 Versions 3.12 — ·Red Hat
- cpe:/a:redhat:quay:3.14::el8 Versions 3.14 — ·Red Hat
- cpe:/a:redhat:quay:3.15::el8 Versions 3.15 — ·Red Hat
- cpe:/a:redhat:quay:3.16::el9 Versions 3.16 — ·Red Hat
- cpe:/a:redhat:quay:3.17::el9 Versions 3.17 — ·Red Hat
- cpe:/a:redhat:quay:3.18::el9 Versions 3.18 — ·Red Hat
- cpe:/a:redhat:quay:3.9::el8 Versions 3.9 — ·Red Hat
Remediation
Red Hat 8 advisories
- RHSA-2026:81110 Released 2026-10-12 · Red Hat rating ImportantRed Hat Quay 3.18.1
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
- RHSA-2026:74511 Released 2026-10-01 · Red Hat rating ImportantRed Hat Quay 3.17.5
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
Show 5 more Red Hat advisories
- RHSA-2026:69255 Released 2026-09-21 · Red Hat rating ImportantRed Hat Quay 3.16.6
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:66523 Released 2026-09-10 · Red Hat rating ImportantRed Hat Quay 3.12.22
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:66084 Released 2026-09-09 · Red Hat rating ImportantRed Hat Quay 3.10.26
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:65514 Released 2026-09-08 · Red Hat rating ImportantRed Hat Quay 3.9.26
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:63307 Released 2026-09-03 · Red Hat rating ImportantRed Hat Quay 3.15.8
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3.10 | Fixed | RHSA-2026:66084 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:66523 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:63307 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:69255 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:74511 |
| Red Hat Quay 3.18 | Fixed | RHSA-2026:81110 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:65514 |
Not affected: 8 products
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.18
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18255
- 2026-10-03 Alias added: GHSA-x8x8-qp2x-c2mj
- 2026-10-12 Fix available: quay/quay-rhel9@1791265590 · CNA
- 2026-10-12 1 new reference · CNA
- 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
- 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-18255 · CVE Program
- CVE-2026-18255 · NVD
- FIRST EPSS
- GHSA-x8x8-qp2x-c2mj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-18255 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences