CVE-2026-110697
Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Record
CVE-2026-110697- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-13
EUVDEUVD-2026-123611
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Record
EUVD-2026-123611- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-cxc6-5mg7-78wq
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern...
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Record
GHSA-cxc6-5mg7-78wq- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-13
NVD
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Record
CVE-2026-110697- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-110697No score
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
- Record
UBUNTU-CVE-2026-110697- Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dataquayUbuntu:16.04:LTS | All versions, plus listed versions 0.9-3 | None known |
dataquayUbuntu:18.04:LTS | All versions, plus listed versions 0.9.1-1 | None known |
dataquayUbuntu:20.04:LTS | All versions, plus listed versions 0.9.1-10.9.1-1build1 | None known |
dataquayUbuntu:22.04:LTS | All versions, plus listed versions 0.9.1-1build1 | None known |
dataquayUbuntu:24.04:LTS | All versions, plus listed versions 0.9.1-1build10.9.1-20.9.1-2build10.9.1-2build20.9.1-2build3 | None known |
dataquayUbuntu:26.10 | All versions, plus listed versions 0.9.5-1 | None known |
dataquayUbuntu:26.04:LTS | All versions, plus listed versions 0.9.1-2build30.9.5-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| products, references | CVE List | |
| products | EUVD, GitHub Advisories, NVD | |
| affected, aliases, products, references | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| references | EUVD | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110697 is a critical vulnerability (CVSS 9.9) in Project Quay Quay, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:99019
Show 9 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2552237
nvd.nist.gov/vuln/detail/CVE-2026-110697
github.com/advisories/GHSA-cxc6-5mg7-78wq
ubuntu.com/security/CVE-2026-110697
cve.org/CVERecord?id=CVE-2026-110697