Skip to content
Fencer Vulns
high 7.2

CVE-2026-18255 json

Quay: quay: global read-only superuser can view robot account tokens

published 2026-07-29 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-50411

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Patch / fix

  • Red Hat Red Hat Quay 3.10 1788561841
  • Red Hat Red Hat Quay 3.12 1788594376
  • Red Hat Red Hat Quay 3.14 1788593843
  • Red Hat Red Hat Quay 3.15 1788191755
  • Red Hat Red Hat Quay 3.16 1789563753
  • Red Hat Red Hat Quay 3.17 1790690298
  • Red Hat Red Hat Quay 3.18 1791265590
  • Red Hat Red Hat Quay 3.9 1788595574

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18255 updated cvss 7.2

quay: quay: Global read-only superuser can view robot account tokens

  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1790690298
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:74511
  • Red Hat Quay 3.18 quay/quay-rhel9 1791265590
    fixed: vendor fix “Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.” RHSA-2026:81110
show 1 more
  • Red Hat Quay 3.9 quay/clair-rhel8 1788595308, quay/quay-builder-rhel8 1788595236, quay/quay-operator-rhel8 1788597635, quay/quay-operator-bundle 1788672362, quay/quay-bridge-operator-rhel8 1788596260, quay/quay-bridge-operator-bundle 1788597015, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1787980047, quay/quay-builder-rhel8 1787980066, quay/quay-operator-rhel8 1787980042, quay/quay-operator-bundle 1788655774, quay/quay-bridge-operator-rhel8 1787980033, quay/quay-bridge-operator-bundle 1787981429, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1788594175, quay/quay-builder-rhel8 1788594175, quay/quay-operator-rhel8 1788595337, quay/quay-operator-bundle 1788598412, quay/quay-bridge-operator-rhel8 1788594065, quay/quay-bridge-operator-bundle 1788595245, +3 more Red Hat Quay 3.14 quay/clair-rhel8 1788593782, quay/quay-builder-rhel8 1788593707, quay/quay-operator-rhel8 1788593658, quay/quay-operator-bundle 1788598271, quay/quay-bridge-operator-rhel8 1788594258, quay/quay-bridge-operator-bundle 1788595604, +3 more Red Hat Quay 3.15 quay/clair-rhel8 1787986213, quay/quay-builder-rhel8 1787824210, quay/quay-operator-rhel8 1787987657, quay/quay-operator-bundle 1788196149, quay/quay-bridge-operator-rhel8 1787986808, quay/quay-bridge-operator-bundle 1787987365, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1789191202, quay/quay-builder-rhel9 1789492236, quay/quay-operator-rhel9 1789190909, quay/quay-operator-bundle 1789627085, quay/quay-bridge-operator-rhel9 1789191073, quay/quay-bridge-operator-bundle 1789191920, +3 more
    +2 more products
    Red Hat Quay 3.17 quay/clair-rhel9 1790689867, quay/quay-builder-rhel9 1790484991, quay/quay-operator-rhel9 1790689856, quay/quay-operator-bundle 1790696576, quay/quay-bridge-operator-rhel9 1790403610, quay/quay-bridge-operator-bundle 1790404339, +3 more Red Hat Quay 3.18 quay/clair-rhel9 1791279250, quay/quay-builder-rhel9 1791305715, quay/quay-rhel9-operator 1791305677, quay/quay-operator-bundle 1791306533, quay/quay-bridge-rhel9-operator 1791279118, quay/quay-bridge-operator-bundle 1791298533, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.18
  • Red Hat Red Hat Quay 3.9

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.