Bug 2552237 (CVE-2026-110697)

Summary: CVE-2026-110697 quay: quay: SQL LIKE wildcard injection in robot listing leaks cross-tenant robot tokens
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: doconnor, rsandu, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-14 14:12:35 UTC 
A flaw was found in Quay. The list_entity_robots function in data/model/user.py constructs a SQL LIKE pattern from a user-controlled namespace name without escaping wildcard metacharacters. Namespace names may contain underscore (), which SQL LIKE treats as a single-character wildcard. A user who owns a namespace with _ in the right position (e.g. ab_c) can list robots belonging to other tenants whose namespace names match the wildcard pattern (e.g. abxc, ab-c), including their decrypted authentication tokens. This allows an attacker to read another tenant's robot tokens and use them to push and pull container images as those robots, take over a victim's robots by renaming the attacker's namespace, or delete a victim's robots by deleting the attacker's namespace. The codebase contains a proper wildcard escaping function (prefix_search in data/text.py) that is not used in the affected code path.