CVE-2026-18255: Quay: quay: global read-only superuser can view robot account tokens

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-10-24
Weakness: CWE-863

Description

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Affected products

Red Hat Quay 3.10: all versions — fixed in 1788561841
Red Hat Quay 3.12: all versions — fixed in 1788594376
Red Hat Quay 3.14: all versions — fixed in 1788593843
Red Hat Quay 3.15: all versions — fixed in 1788191755
Red Hat Quay 3.16: all versions — fixed in 1789563753
Red Hat Quay 3.17: all versions — fixed in 1790690298
Red Hat Quay 3.18: all versions — fixed in 1791265590
Red Hat Quay 3.9: all versions — fixed in 1788595574

How to fix

Upgrade to a fixed version: Red Hat Quay 3.10 1788561841; Red Hat Quay 3.12 1788594376; Red Hat Quay 3.14 1788593843; Red Hat Quay 3.15 1788191755; Red Hat Quay 3.16 1789563753; Red Hat Quay 3.17 1790690298; Red Hat Quay 3.18 1791265590; Red Hat Quay 3.9 1788595574. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18255 or the next vulnerability affects your stack