CVE-2026-18255: Quay: quay: global read-only superuser can view robot account tokens
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.
Other sources
Reproduction steps:
1. Configure a user in GLOBALREADONLYSUPERUSERS only. 2. Confirm the same user is not present in SUPERUSERS. 3. Apply config and allow Quay/operator reconciliation. 4. Log in as that user. 5. Navigate to robot account management and token views for a repo they are not a member of. 6. Observe that token visibility is allowed.
Impact: Read-only administrative users can perform actions beyond intended scope. Robot account tokens are persistent by default (they do not expire), and depending on configuration can grant read (pull), write (push), or admin level access to container image repositories.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure GLOBAL_READONLY_SUPER_USERS to include only the specific user(s) that should have read-only superuser privileges. Do not include additional users.
Quay GLOBAL_READONLY_SUPER_USERS = Remove any unintended users; configure only the required user(s) - Configuration
Confirm that the user configured in GLOBAL_READONLY_SUPER_USERS is not also present in SUPER_USERS.
Quay SUPER_USERS = Ensure the same user is not present - Compensating control
Apply configuration changes and allow Quay/operator reconciliation so the corrected GLOBAL_READONLY_SUPER_USERS/SUPER_USERS settings take effect.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18255?
CVE-2026-18255 has a high severity rating of 7.2.
How can I fix CVE-2026-18255?
To mitigate CVE-2026-18255, ensure that sensitive user roles are not configured in GLOBAL_READONLY_SUPER_USERS.
What are the implications of CVE-2026-18255?
CVE-2026-18255 allows a user with read-only superuser privileges to access robot account tokens for repositories they do not belong to, leading to potential impersonation.
What software is affected by CVE-2026-18255?
CVE-2026-18255 affects Quay, specifically the Quay software used for container image storage.
When was CVE-2026-18255 published?
CVE-2026-18255 was published on July 29, 2026.