REDHAT-BUG-2516139: Medium severity Red Hat Quay vulnerability
A flaw was found in Red Hat Quay's JWT token validation for federated robot accounts and SSO authentication. Three related issues were identified: (1) When no audiences are configured for federated robot authentication (the default), verifyaud is set to False, accepting any validly-signed token from the same IdP regardless of intended audience. (2) The OIDCALLOWEDCLIENTS / azp enforcement check in auth/oauth.py short-circuits when the azp claim is absent from the token (None), allowing tokens without an azp claim to bypass client restrictions. (3) Pre-existing federation configurations created before API validation enforcement (or written directly to the database) without a subject field allow tokens without a sub claim to match. These issues could allow an attacker with a validly-signed token from the same identity provider to bypass configured audience, subject, or authorized-client restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the OIDC_ALLOWED_CLIENTS / azp enforcement in auth/oauth.py so the enforcement does not short-circuit when the azp claim is absent (None), and client restrictions are still applied.
Red Hat Quay (auth/oauth.py) OIDC_ALLOWED_CLIENTS / azp enforcement check (azp claim handling) = Ensure azp is required for enforcement (do not short-circuit when azp is absent) - Configuration
For federated robot authentication, do not set verify_aud to False by default when no audiences are configured; ensure audience verification is performed so validly-signed tokens are still checked against intended audience restrictions.
Red Hat Quay federated robot authentication JWT validation verify_aud = True when audiences are not configured - Configuration
Update/validate pre-existing federation configurations created before API validation enforcement (or written directly to the database) so they include the subject field; ensure tokens without a sub claim do not match those configurations.
Red Hat Quay federated robot authentication / federation configurations Federation configuration subject field presence (sub claim matching) = Require subject (sub) mapping for pre-existing configurations created before enforcement
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2516139?
The severity of REDHAT-BUG-2516139 is medium with a risk rating of 4.
How do I fix REDHAT-BUG-2516139?
To fix REDHAT-BUG-2516139, ensure that audiences are correctly configured for federated robot authentication to enable proper JWT token validation.
What software is affected by REDHAT-BUG-2516139?
REDHAT-BUG-2516139 affects Red Hat Quay.
What type of flaw is identified in REDHAT-BUG-2516139?
REDHAT-BUG-2516139 identifies a flaw in JWT token validation for federated robot accounts and SSO authentication.
When was REDHAT-BUG-2516139 published?
REDHAT-BUG-2516139 was published on August 14, 2026.