Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-110697 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | Red Hat |
| Product | Quay |
| Vulnerability Type | improper neutralization in SQL query (CWE-89) |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants’ namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Robot account tokens are typically used by CI/CD pipelines to push and pull images — stealing them allows an attacker to replace a container image that ends up in production. A second critical Quay flaw was published at the same time — CVE-2026-123710.
Required Actions
- Update Red Hat Quay to the fixed version listed on the Red Hat page for CVE-2026-110697.
- After updating, rotate robot account tokens — especially in instances shared by multiple teams or customers.
- Review Quay audit logs for unexpected push/tag operations performed by robot accounts.
- Until updated, restrict users’ ability to create new namespaces (organizations).
Who Is Affected?
The vulnerability affects Red Hat Quay — a private container image registry often deployed alongside OpenShift. Multi-tenant instances shared by several teams or customers are most exposed.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-110697 vulnerability?
CVE-2026-110697 is a flaw in Red Hat Quay (CWE-89): an unescaped SQL LIKE pattern in robot account listing exposes other tenants' tokens. CVSS score: 9.9.
Does exploiting CVE-2026-110697 require authentication?
Yes, the attacker needs a low-privileged account that can create a namespace in Quay.
How to protect against CVE-2026-110697?
Update Red Hat Quay to the fixed version, rotate robot account tokens and review audit logs.
Who is affected by CVE-2026-110697?
Organizations running Red Hat Quay, especially in a multi-tenant setup.
