Authorization Bypass in Red Hat Quay

hello@craftedsignal.io — Wed, 29 Jul 2026 17:17:44 +0000

A security vulnerability identified as CVE-2026-18255 affects Red Hat Quay 3. The issue stems from an incorrect authorization flaw (CWE-863) where users assigned to the GLOBAL_READONLY_SUPER_USERS role can improperly access and view robot account tokens associated with repositories they do not own or possess membership in. By successfully retrieving these tokens, an attacker with read-only superuser privileges can impersonate any robot account within the environment, effectively bypassing intended access restrictions. This vulnerability poses a significant risk to the integrity and confidentiality of container image registries managed by Red Hat Quay. Administrators should prioritize identifying users with excessive read-only privileges and applying relevant security patches provided by Red Hat to mitigate this privilege escalation vector.

Impact

Successful exploitation allows for the unauthorized impersonation of robot accounts, which may be used for automated image pulls, pushes, or other CI/CD pipeline activities. Depending on the privileges granted to the targeted robot accounts, this could lead to the unauthorized exfiltration of container images or the injection of malicious images into repositories, impacting the software supply chain of affected organizations.

Recommendation

Update Red Hat Quay 3 instances to the latest security version provided by Red Hat to remediate CVE-2026-18255.
Review the list of users configured within the GLOBAL_READONLY_SUPER_USERS role and apply the principle of least privilege.
Audit access logs for unusual patterns of repository access or API token retrieval by administrative accounts.

Red Hat Quay 3 - CraftedSignal Threat Feed

Authorization Bypass in Red Hat Quay

Impact

Recommendation