A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation quay: quay: Global read-only superuser can view robot account tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input podman: Podman: Information disclosure via malicious container image environment variables js-yaml: js-yaml: Denial of Service via crafted YAML documents nanoid: nanoid: Denial of Service via negative size input in non-secure module functions axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter axios: axios: Denial of Service via object serialization bypass brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL nanoid: nanoid: Predictable ID generation due to integer overflow browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Quay ausnutzen, um Informationen offenzulegen, die zur Darstellung als bestimmte Konten verwendet werden können.