A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.

The Quay config-tool's GitLab OAuth validator in pkg/lib/shared/validators.go (line 804) places clientid and clientsecret as plaintext URL querystring parameters when making POST requests to the configured GitLab endpoint. This causes credentials to leak into server access logs, reverse proxy logs, WAF logs, CDN logs, and OpenTelemetry traces even when the endpoint is the legitimate gitlab.com. The GitHub OAuth validator correctly uses HTTP Basic Auth headers and is not affected.

A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering. This allows the attacker to perform internal network reconnaissance from the Quay pod's network position, potentially mapping the internal network infrastructure.

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.

There's a privilege escalation vulnerability in quay-app container for the Mirror Registry application, where an attacker with access to the containerized pod can escalate its privilege to root access within the pod environment.