EUVD-2026-33272
GHSA-f2q6-8fx7-gjf8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.
AnalysisAI
Credential exposure in Red Hat Quay 3's config-tool GitLab OAuth validator allows OAuth client_id and client_secret to leak into system logs. The config-tool incorrectly appends these sensitive values as URL query parameters on POST requests to the GitLab endpoint, causing them to appear in server access logs, reverse proxy logs, and monitoring infrastructure. A highly privileged attacker with read access to those log systems can harvest the exposed OAuth credentials and use them for unauthorized GitLab API access. No public exploit code exists and this is not listed in CISA KEV.
Technical ContextAI
Red Hat Quay 3 (CPE: cpe:2.3:a:red_hat:red_hat_quay_3) ships a config-tool that validates GitLab OAuth integrations. OAuth 2.0 credentials - specifically client_id and client_secret - are meant to be transmitted in the HTTP POST request body or as Authorization headers, never as URL query parameters. CWE-598 (Use of GET Request Method With Sensitive Query Strings) captures this broader class of defect: placing secrets in the URL exposes them to any system that logs the full request URI, including web servers (e.g., nginx, Apache), reverse proxies, load balancers, SIEM pipelines, and browser/network history. Even though the HTTP method is POST, query-string secrets are equally visible in server access logs as they are for GET requests. This means credential exposure is not gated on network interception but on log access - a much wider attack surface in enterprise environments with centralized logging.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-10078 for the official patched release; no specific fixed version number is independently confirmed from the available input data. The underlying fix should move GitLab OAuth credential parameters (client_id, client_secret) from URL query strings into the HTTP POST request body, consistent with OAuth 2.0 best practices. As an immediate compensating control pending patch application, restrict read access to server access logs, reverse proxy logs, and any centralized log aggregation systems to the minimum required personnel - this prevents opportunistic credential harvesting from existing log records. Additionally, rotate any GitLab OAuth client_secret values that were transmitted through Quay's config-tool while the vulnerable version was in use, as previously captured log entries may already contain the exposed credentials. Disabling the GitLab OAuth validation feature in config-tool entirely is an option for organizations that do not use GitLab integration, eliminating the exposure at the cost of losing that authentication pathway.
More in Red Hat Quay 3
View allAuthenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deser
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concur
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated reposi
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization adminis
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today