CVE-2026-10078: Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring
A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.
Other sources
The Quay config-tool's GitLab OAuth validator in pkg/lib/shared/validators.go (line 804) places clientid and clientsecret as plaintext URL querystring parameters when making POST requests to the configured GitLab endpoint. This causes credentials to leak into server access logs, reverse proxy logs, WAF logs, CDN logs, and OpenTelemetry traces even when the endpoint is the legitimate gitlab.com. The GitHub OAuth validator correctly uses HTTP Basic Auth headers and is not affected.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10078?
The severity of CVE-2026-10078 is low, rated at 2.7.
How do I fix CVE-2026-10078?
To fix CVE-2026-10078, it's recommended to avoid using the client_secret in URL query parameters and use secure methods for authentication.
What are the risks associated with CVE-2026-10078?
CVE-2026-10078 poses a risk of exposing sensitive credentials due to insecure transmission in URL query parameters.
Is CVE-2026-10078 exploitable remotely?
Yes, CVE-2026-10078 is exploitable remotely since it involves the transmission of credentials during API calls.
What products are affected by CVE-2026-10078?
CVE-2026-10078 affects the Quay config-tool specifically in connection with GitLab OAuth.