CVE-2026-102576

In Quay, an authenticated attacker can access auto-prune configurations of repositories from other namespaces, leading to unauthorized information disclosure. The issue is due to improper enforcement of namespace scoping when retrieving policy details.

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.

A cross-site scripting (XSS) vulnerability was found in Quay's OAuth callback handler. By tricking a logged-in user into visiting a specially crafted link, an attacker can execute arbitrary JavaScript in the user's browser session due to improper input sanitization.

In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.

In Quay, the filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline via CDN, enabling stored XSS.

In the Quay config-tool's GitLab OAuth validator, sensitive credentials (client_id and client_secret) are transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This can lead to disclosure of these credentials in system logs such as server access logs, reverse proxy logs, and other monitoring systems.

A flaw was found in Quay where when an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted 'Admin' permissions on the newly created repository.