CVE-2026-105447

Received Received - Intake

Quay Repository Write Token Exposure via Build Trigger API

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: redhat-SADP

Description

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105447

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	quay	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Quay allows an authenticated read-only user to access build trigger configurations containing repository write tokens. By querying the build trigger API, they can retrieve these tokens and use them to push arbitrary container images to private repositories, bypassing read-only restrictions.

Detection Guidance

Check Quay build trigger API logs for unauthorized access attempts by read-only users. Inspect API responses for exposed repository write tokens in trigger configurations. Monitor for unexpected push operations to private repositories by users with read-only privileges.

Impact Analysis

If you are a Quay user with read-only access, an attacker could exploit this flaw to gain write access to your private repositories. This could lead to unauthorized code or container images being pushed, potentially compromising your systems or data.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized image pushes may expose regulated data.

Mitigation Strategies

Update Quay to the latest patched version immediately. Review and revoke all exposed repository write tokens. Restrict API access for read-only users to prevent unauthorized trigger queries. Implement stricter access controls on build trigger configurations.

Hi! I’m here to help you understand CVE-2026-105447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70