What is the CVSS score of CVE-2026-10078?

CVE-2026-10078 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Red Hat Quay CVE-2026-10078

EUVD-2026-33272 LOW

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-05-29 redhat

GHSA-f2q6-8fx7-gjf8

Information Disclosure Gitlab

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 11:01 vuln.today

DescriptionCVE.org

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.

AnalysisAI

Credential exposure in Red Hat Quay 3's config-tool GitLab OAuth validator allows OAuth client_id and client_secret to leak into system logs. The config-tool incorrectly appends these sensitive values as URL query parameters on POST requests to the GitLab endpoint, causing them to appear in server access logs, reverse proxy logs, and monitoring infrastructure. A highly privileged attacker with read access to those log systems can harvest the exposed OAuth credentials and use them for unauthorized GitLab API access. No public exploit code exists and this is not listed in CISA KEV.

Technical ContextAI

Red Hat Quay 3 (CPE: cpe:2.3:a:red_hat:red_hat_quay_3) ships a config-tool that validates GitLab OAuth integrations. OAuth 2.0 credentials - specifically client_id and client_secret - are meant to be transmitted in the HTTP POST request body or as Authorization headers, never as URL query parameters. CWE-598 (Use of GET Request Method With Sensitive Query Strings) captures this broader class of defect: placing secrets in the URL exposes them to any system that logs the full request URI, including web servers (e.g., nginx, Apache), reverse proxies, load balancers, SIEM pipelines, and browser/network history. Even though the HTTP method is POST, query-string secrets are equally visible in server access logs as they are for GET requests. This means credential exposure is not gated on network interception but on log access - a much wider attack surface in enterprise environments with centralized logging.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-10078 for the official patched release; no specific fixed version number is independently confirmed from the available input data. The underlying fix should move GitLab OAuth credential parameters (client_id, client_secret) from URL query strings into the HTTP POST request body, consistent with OAuth 2.0 best practices. As an immediate compensating control pending patch application, restrict read access to server access logs, reverse proxy logs, and any centralized log aggregation systems to the minimum required personnel - this prevents opportunistic credential harvesting from existing log records. Additionally, rotate any GitLab OAuth client_secret values that were transmitted through Quay's config-tool while the vulnerable version was in use, as previously captured log entries may already contain the exposed credentials. Disabling the GitLab OAuth validation feature in config-tool entirely is an option for organizations that do not use GitLab integration, eliminating the exposure at the cost of losing that authentication pathway.