CVE-2026-110697 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-110697 requires immediate attention.

· 8 min read

Executive Summary

CVE-2026-110697 is a critical cross-tenant credential theft issue in Quay (CVSS 9.9). The flaw is in the robot account listing flow: Quay builds a SQL LIKE pattern from a namespace name supplied by the user, but does not escape wildcard characters. An attacker who creates a namespace containing an underscore can cause the listing query to match robot accounts from other tenants and retrieve their decrypted authentication tokens. That can lead to unauthorized image pushes/pulls, registry tampering, and broader supply-chain compromise.

This is especially urgent for solo developers and small teams because a single compromised registry account can expose private images, CI/CD secrets, and deployment pipelines. Even though there is no known exploitation in the wild and it is not in CISA KEV, the impact is severe enough to treat as an emergency patch.

Immediate Action

  • Patch Quay immediately to the first vendor-fixed release. If you do not know the fixed version yet, use the latest supported release and consult the vendor advisory: vendor advisory.
  • Restrict namespace creation until patched. Temporarily disable self-service namespace/org creation or require admin approval for new namespaces.
  • Rotate all robot account tokens after patching, especially for tenants that share the same Quay instance.
  • Audit registry activity for unexpected image pushes, pulls, token creation, and namespace creation around the exposure window.
  • Isolate the registry from public access if feasible: limit to VPN, allowlisted IPs, or internal network only until remediation is complete.
  • Rollback guidance: if the upgrade breaks service, roll back only to a known-good image version that is not vulnerable; do not leave the vulnerable build in production.

Affected Versions

  • quay@<= TODO_VULNERABLE_VERSION vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • quay-operator@<= TODO_VULNERABLE_VERSION vulnerable if it deploys the affected Quay release; upgrade to TODO_FIXED_VERSION or later.
  • quay-frontend / quay-app / quay-enterprise images at or below the affected release are vulnerable; use the patched image tag from the vendor.

Note: If your deployment pins a digest, verify the underlying Quay release. A “safe” tag is only safe if it maps to the fixed build.

Resolution Guide

Container / Docker

docker pull <vendor-registry>/quay:<TODO_FIXED_VERSION>
docker stop quay
docker rm quay
docker run -d --name quay --restart unless-stopped \
  -p 80:8080 -p 443:8443 \
  -v quay-data:/data \
  <vendor-registry>/quay:<TODO_FIXED_VERSION>

Kubernetes / Helm

helm repo update
helm upgrade quay <chart-name> \
  --set image.tag=<TODO_FIXED_VERSION> \
  --reuse-values

Linux package managers If your environment installs Quay components via OS packages, update to the vendor-fixed package version:

# Debian/Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade quay=<TODO_FIXED_VERSION>

# RHEL/CentOS/Fedora
sudo yum update quay-<TODO_FIXED_VERSION>
# or
sudo dnf upgrade quay

JavaScript / Python / Java ecosystems If your deployment wraps Quay in tooling, operators, or automation libraries, update those dependencies too:

# npm / yarn / pnpm
npm i <package>@<TODO_FIXED_VERSION>
yarn add <package>@<TODO_FIXED_VERSION>
pnpm add <package>@<TODO_FIXED_VERSION>

# pip / pipx
pip install --upgrade <package>==<TODO_FIXED_VERSION>
pipx upgrade <package>

# Maven
<dependency>
  <groupId>TODO

Hardening while you patch

# Disable or restrict namespace creation in your app/portal
QUAY_FEATURE_NAMESPACE_CREATION=false

# If supported, require admin approval for new namespaces
QUAY_REQUIRE_NAMESPACE_APPROVAL=true

# Temporarily limit registry access
# Example: allow only internal CIDRs at the firewall or ingress layer

Code fix example If you maintain a fork or custom integration, escape SQL wildcard characters before building the LIKE pattern:

def escape_like(value: str) -> str:
    return value.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")

pattern = f"{escape_like(namespace_name)}%"
query = """
SELECT ...
FROM robot_accounts
WHERE namespace_name LIKE %s ESCAPE '\\'
"""
cursor.execute(query, (pattern,))

Detection & Verification

Check your version

quay --version
docker image inspect <vendor-registry>/quay:<tag> --format '{{.RepoTags}}'
helm list -A | grep -i quay

Look for vulnerable code paths If you have source or a custom build, search for unescaped LIKE usage around robot account listing:

grep -RIn "LIKE" .
grep -RIn "robot account" .
grep -RIn "namespace.*LIKE" .

Verify the fix

# Confirm the running image tag/digest changed
docker ps --format '{{.Image}}' | grep quay

# Re-run version checks after upgrade
quay --version

# Functional test: create a namespace with an underscore and confirm it does NOT match other tenants
# Example query should return only the expected tenant's robot accounts
# (Use your normal admin/API tooling to validate)

Dependency and image audit

docker scout cves <vendor-registry>/quay:<tag>
trivy image <vendor-registry>/quay:<tag>
grype <vendor-registry>/quay:<tag>

Risk and Impact

An attacker can abuse this flaw to enumerate and steal robot account tokens from other tenants by creating a namespace with a wildcard character. Those tokens may allow image push/pull operations, repository tampering, and unauthorized access to private artifacts. In a small-team environment, that can quickly become a full registry compromise, including poisoned builds and downstream deployment risk.

Because the issue crosses tenant boundaries, the blast radius is larger than a single account: any shared Quay instance with multiple namespaces is potentially exposed. Treat this as a credential-theft incident, not just a bug fix.

Keep reading