External risk intelligence

Quay Robot Account Listing SQL Injection Allows Cross-Tenant Credential Theft

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-110697

Quay is a container registry platform commonly deployed as a network-accessible service to manage container images for development and production environments. It functions as a centralized gateway for image distribution, making its web-based management interface and API endpoints frequently exposed or reachable within organizations and often directly on the internet for external registry access.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in the Quay container registry that could allow an unauthorized user to access sensitive information and perform unauthorized actions. This flaw involves how user-provided names are processed, potentially exposing credentials and other data across different tenants.

Stolen credentials could impact data security.
Confirms a vulnerability allowing cross-tenant data access.
Review Quay's exposure and tenant data.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Quay can exploit a flaw in how user-provided namespace names are handled when listing robot accounts. By creating a namespace with a specific character, an attacker can manipulate SQL queries to access robot accounts and their credentials belonging to other tenants. This could lead to the theft of sensitive authentication tokens and the ability to perform unauthorized actions on container images.

Authenticated user access required.
Specially crafted namespace name triggers SQL injection.
Cross-tenant credential theft and unauthorized operations.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in Quay could allow an attacker to access robot account credentials from other tenants. This occurs when a namespace name containing a special character is used, enabling the attacker to potentially retrieve authentication tokens and perform unauthorized actions on container images.

Robot account credentials and tokens.
User-controlled namespace name injection.
Unauthorized access to container images.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Quay, allowing cross-tenant credential theft, likely impacts platform teams managing the registry and security teams responsible for sensitive credentials. The first practical step is to identify all Quay instances, confirm their reachability and business criticality, and then determine the accountable owner for remediation planning.

Platform and security teams should own.
Verify Quay instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Quay and why do teams use it?

Quay is a container registry platform that provides a centralized hub for organizations to store, manage, and distribute container images. It is commonly deployed to support development and production workflows, serving as a critical infrastructure component that enables teams to host their software images securely and manage access to them through various authentication methods.

How does CVE-2026-110697 work as a SQL injection flaw?

This vulnerability, classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), occurs because Quay fails to properly sanitize user-provided namespace names. By injecting specific SQL wildcard characters like an underscore, an attacker can manipulate the database query used to list robot accounts, causing it to return results from namespaces they do not own.

Do I need special privileges to trigger this bug?

Yes, an attacker must have authenticated access to the Quay instance to exploit this flaw. The issue is triggered specifically when a user creates a namespace containing an underscore character to interact with the robot account listing function. Simply viewing or browsing legitimate namespaces without this specific malicious input does not trigger the vulnerability.

Is my Quay instance at risk if it is internal?

Halo Surface Signal indicates that Quay is often deployed as a network-accessible service, sometimes directly on the internet for external registry access. While internet-exposed instances face the highest risk, internal instances are still vulnerable if an attacker gains authenticated access to the system. You should evaluate your instance's reachability to determine its overall risk level.

When should I prioritize fixing this vulnerability?

Because this flaw allows for cross-tenant credential theft and unauthorized image operations, it should be treated as a high-priority item for platform and security teams. Begin by identifying all running Quay instances in your environment, verifying their business criticality, and establishing a clear ownership structure to plan and implement the necessary updates or security mitigations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.