A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Quay 3 | affected | — |
| Red Hat | Red Hat Quay 3 | affected | — |
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.
References
History
Wed, 29 Jul 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. | |
| Title | Quay: quay: global read-only superuser can view robot account tokens | |
| First Time appeared |
Redhat
Redhat quay |
|
| Weaknesses | CWE-863 | |
| CPEs | cpe:/a:redhat:quay:3 | |
| Vendors & Products |
Redhat
Redhat quay |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-07-29T16:34:44.442Z
Reserved: 2026-07-29T16:19:25.998Z
Link: CVE-2026-18255
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses