UBUNTU-CVE-2026-110697: Medium severity ubuntu/dataquay vulnerability
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Quay deployments using the affected robot account listing functionality are exposed where an attacker can create a namespace containing an underscore. The impact can cross tenant boundaries, exposing robot account credentials from other namespaces.
What does an attacker need to exploit it?
The attacker needs the ability to create a namespace with an underscore character in its name and invoke the robot account listing behavior. The wildcard handling can then cause the query to match robot accounts belonging to other tenants.
What could an attacker obtain or do?
An attacker may retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces. Those credentials can enable unauthorized image operations.