A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a… (CVE-2026-18255)

CVE-2026-18255 is a security flaw in Red Hat Quay where users configured with GLOBAL_READONLY_SUPER_USERS privileges can view robot account tokens for repositories they are not members of. This exposure allows an attacker with read-only superuser privileges to impersonate any robot account. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Red Hat has issued an official security advisory (RHSA-2026:63307) and released Quay 3.15.8 containing the fix.

An attacker with GLOBAL_READONLY_SUPER_USERS privileges can access robot account tokens for repositories they do not have membership in, enabling impersonation of robot accounts. This can lead to unauthorized actions performed under the identity of those robot accounts, compromising confidentiality, integrity, and availability of the affected systems.

Red Hat has released Quay version 3.15.8 which fixes this vulnerability. Users should apply this update after ensuring all prior relevant errata are applied. Refer to the Red Hat advisory RHSA-2026:63307 for detailed update instructions. No additional mitigation steps are indicated by the vendor.