Red Hat Quayにテナント間のトークン漏えい脆弱性、修正版あり

CVE-2026-110697 First seen on SecPulse Nov 12, 02:06

Summary

Red Hat Quayで、別テナントのロボットアカウントと認証トークンを取得される脆弱性が11月11日に公表されました。複数チームでレジストリを共有する組織は、修正版へ更新し、トークンの不審な利用がないかも確認してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Red Hat	Red HatRed Hat OpenShift Update Service	—	Not listed
Red Hat	Red HatRed Hat Quay 3	—	Not listed
Red Hat	Red HatRed Hat Quay 5	—	Not listed
Red Hat	Red HatRed Hat Quay 3.10	—	Not listed
Red Hat	Red HatRed Hat Quay 3.14	—	Not listed
Red Hat	Red HatRed Hat Quay 3.15	—	Not listed
Red Hat	Red HatRed Hat Quay 3.16	—	Not listed
Red Hat	Red HatRed Hat Quay 3.18	—	Not listed
Red Hat	Red HatRed Hat Quay 3.9	—	Not listed
Red Hat	Red HatRed Hat Quay 3.12	—	Not listed
Red Hat	Red HatRed Hat Quay 3.17	—	Not listed
Project Quay	Project Quayquay	< 3.9.28→ 3.9.28 ≥ 3.10.0, < 3.10.28→ 3.10.28 ≥ 3.12.0, < 3.12.24→ 3.12.24 ≥ 3.14.0, < 3.14.10→ 3.14.10 ≥ 3.15.0, < 3.15.9→ 3.15.9 ≥ 3.16.0, < 3.16.7→ 3.16.7 ≥ 3.17.0, < 3.17.7→ 3.17.7 ≥ 3.18.0, < 3.18.3→ 3.18.3	3.9.28 3.10.28 3.12.24 3.14.10 3.15.9 3.16.7 3.17.7 3.18.3

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Ubuntu UBUNTU-CVE-2026-110697 dataquay No fixed version in this record

Original description The description as published by the source.

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 02:06
GHSA: GHSA-cxc6-5mg7-78wq
CWE: CWE-89

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-89

Vendors

Red Hat

All

Red Hat Openshift Update Service Red Hat Quay 3 Red Hat Quay 5 Red Hat Quay 310 Red Hat Quay 314 Red Hat Quay 315 Red Hat Quay 316 Red Hat Quay 318 Red Hat Quay 39 Red Hat Quay 312 Red Hat Quay 317 Project Quay Quay

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database18:17
GitHub Security Advisories (Global)09:31
Red Hat Security AdvisoriesNov 12, 09:25
CVE.org (CVE Program・cvelistV5)18:13