CVE-2026-110697

Name of the Vulnerable Software and Affected Versions Quay (affected versions not specified)

Description A flaw exists in the robot account listing function that constructs a SQL LIKE pattern using user-controlled namespace names without escaping wildcard metacharacters. An attacker can create a namespace containing an underscore character to match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces. This leads to cross-tenant credential theft and unauthorized image operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.