CVE-2026-18255
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.
Risk Assessment
An attacker can gain access to repositories and perform actions on behalf of robot accounts, potentially leading to unauthorized data access.
Recommendation
Restrict the GLOBAL_READONLY_SUPER_USERS list or apply proper access controls.
Other vulnerabilities in Quay
See all- CVE-2026-11569Medium
In Quay, the filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline via CDN, enabling stored XSS.
- CVE-2026-10078Low
In the Quay config-tool's GitLab OAuth validator, sensitive credentials (client_id and client_secret) are transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This can lead to disclosure of these credentials in system logs such as server access logs, reverse proxy logs, and other monitoring systems.
- CVE-2025-4374Medium
A flaw was found in Quay where when an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted 'Admin' permissions on the newly created repository.
Original NVD description (English source)
A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.