CVE-2026-110697 Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens
CriticalCVSS 9.9
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/quay/quay-rhel8(Red Hat:quay:3) | All versions | No fix listed |
| redhat/quay/quay-rhel9(Red Hat:quay:3) | All versions | No fix listed |
| redhat/quay/quay-rhel9(Red Hat:quay:5) | All versions | No fix listed |
| redhat openshift update service | = 5 | No fix listed |
| redhat quay | All versions | No fix listed |
References
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- Red Hat Bugzilla 2552237 issue-tracking
- www.cve.org
- nvd.nist.gov