#quay
2 articles
Security Alerts Nov 11, 2026
CVE-2026-110697: Cross-Tenant Token Theft in Red Hat Quay
The robot account listing in Red Hat Quay builds a SQL LIKE pattern from namespace names without escaping. An attacker can retrieve other tenants' robot tokens and operate on their images...
Security Alerts Nov 11, 2026
CVE-2026-123710: Signing Key Takeover in Red Hat Quay
An unauthenticated Red Hat Quay client can install its own non-expiring signing key and issue tokens granting read and write access to any repository, including private ones...