Red Hat Quay: SQL injection in robot account listing (CVE-2026-110697)

Red Hat Quay is affected by a critical SQL injection vulnerability (CVE-2026-110697) within the robot account listing function. The application constructs a SQL LIKE pattern using user-controlled namespace names without sanitizing wildcard metacharacters. An attacker can create a namespace containing an underscore character to match and exfiltrate robot accounts and their decrypted authentication tokens from other tenants. This flaw breaks tenant isolation, leading to unauthorized image operations and cross-tenant credential theft.

Impact

Successful exploitation allows authenticated attackers to bypass tenant isolation boundaries, resulting in the theft of robot account credentials and decrypted tokens from any namespace in the Quay instance. This enables unauthorized read and write operations on container images across the entire platform.

Recommendation

1. Review the official Red Hat security advisory to identify patched versions of Quay.
2. Apply the relevant patch immediately to all affected Quay deployments.
3. Audit existing namespace naming conventions to ensure no unauthorized namespaces containing underscore characters have been created during the window of exposure.
4. Perform a rotation of all robot account tokens if suspicious cross-tenant activity is identified in audit logs.