AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-18255

Quay. A user configured: improper authorization

Red Hat

CVE-2026-18255 · Published Jul 29, 2026 · updated Oct 1, 2026

High7.2
No fix yet
Red Hat advisory

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Red Hat advisories

All Red Hat
High 7.8Jul 29Red Hat BFD: out-of-bounds writeCVE-2026-18220no fix yetMedium 5.5Jul 29Red Hat Data Grid 8: missing authorizationCVE-2026-18201no fix yetMedium 6.5Jul 29Red Hat client policy enforcement mechanism of Keycloak: improper authorizationCVE-2026-18207no fix yetHigh 7.8Jul 28Red Hat CRIU: code injectionCVE-2026-18107no fix yetHigh 7.6Jul 28Red Hat sg3_utils. The sg_inq command: code executionCVE-2026-16313no fix yetHigh 8.5Jul 28A flaw was found in openshift/oauth-proxyCVE-2026-49332no fix yet