Critical Red Hat Quay flaws expose private container images
CVE-2026-123710 and CVE-2026-110697 let attackers read or overwrite images; anonymous access can be enough.
74
CVE-2026-110697
SQL wildcard injection in Quay robot account listing
- CVSS 3.1
- 9.9 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Quay's robot account listing builds a SQL LIKE pattern from namespace names without escaping wildcard characters. A low-privileged user who creates a namespace containing an underscore can match other tenants' robot accounts and read their decrypted authentication tokens over the network, with no user interaction. Stolen tokens allow cross-tenant credential theft and unauthorized image operations. Affected Quay versions are not stated.
What to do: Apply Red Hat's update for CVE-2026-110697. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Red Hat Quay | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In the news
2 storiesCritical Red Hat Quay flaw can expose and overwrite private images
CVE-2026-123710 scores 9.8; any valid account can install a persistent signing key, and no fixed version is named.
68