CVE-2026-10078

Name of the Vulnerable Software and Affected Versions Quay config-tool (affected versions not specified)

Description A flaw in the GitLab OAuth validator causes sensitive credentials, specifically client id and client secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in server access logs, reverse proxy logs, and other monitoring systems, potentially allowing an attacker with log access to obtain the credentials and achieve unauthorized information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.