What is the CVSS score of CVE-2026-18255?

CVE-2026-18255 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat Quay are affected by CVE-2026-18255?

A vulnerability in Red Hat Quay 3 enables read-only administrators to extract long-lived container registry credentials and escalate to full repository access.

How to fix or mitigate CVE-2026-18255?

Within 24 hours, immediately audit all users assigned to the GLOBAL_READONLY_SUPER_USERS role in Red Hat Quay 3 and rotate all active robot account tokens; document which tokens were accessible to identify potential compromise. Within 7 days, restrict GLOBAL_READONLY_SUPER_USERS role assignment to essential personnel only, implement comprehensive audit logging for all token access attempts, and monitor for suspicious container registry pull/push activity that may indicate token misuse. Within 30 days, establish a monitoring plan to track vendor security advisories for patched Red Hat Quay versions and develop an upgrade timeline; concurrently evaluate architectural changes such as creating isolated read-only service accounts that lack visibility into robot account credentials to reduce future exposure.

Red Hat Quay CVE-2026-18255

EUVD-2026-50411 HIGH

Incorrect Authorization (CWE-863)

2026-07-29 redhat

GHSA-x8x8-qp2x-c2mj

Authentication Bypass Red Hat Quay 3 Red Hat

7.2

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Requires the elevated GLOBAL_READONLY_SUPER_USERS role so PR:H; network-accessible with no interaction (AV:N/AC:L/UI:N), and leaked robot tokens grant full repository read/write, so C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.2 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 17:02 vuln.today

CVE Published

Jul 29, 2026 - 16:34 cve.org

HIGH 7.2

DescriptionCVE.org

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

AnalysisAI

Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read the tokens of robot accounts belonging to repositories they are not a member of. Because these tokens are long-lived registry credentials, the read-only superuser can escalate a view-only role into full impersonation of any robot account, gaining whatever push/pull and repository permissions that robot holds. No public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

Red Hat Quay is an enterprise container image registry. Robot accounts are non-human service identities used to automate image pull/push in CI/CD and Kubernetes deployments, each authenticated by a static long-lived token that functions as a bearer credential. The GLOBAL_READONLY_SUPER_USERS setting is intended to grant global visibility across the registry without any write capability. The root cause maps to CWE-863 (Incorrect Authorization): the authorization check that gates robot-token visibility fails to enforce repository membership for this role, so the read-only superuser is granted access to a secret it should never be able to read. The affected component is red_hat_quay_3 (cpe:2.3:a:red_hat:red_hat_quay_3), and Red Hat classifies this as an authentication/authorization bypass.

RemediationAI

No vendor-released patch version is identified in the provided data - monitor the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-18255) and Bugzilla 2508454 (https://bugzilla.redhat.com/show_bug.cgi?id=2508454) for the errata (RHSA/RHBA) and upgrade Quay 3 to the fixed build as soon as it is published. As an immediate compensating control, remove or minimize accounts in the GLOBAL_READONLY_SUPER_USERS list and restrict that role to fully trusted administrators only, since it currently confers robot-token read access it should not have; the trade-off is loss of delegated read-only global visibility for auditors or support staff. Additionally, rotate any robot account tokens that may have been exposed to read-only superusers and audit access logs for anomalous robot-account authentication, accepting that token rotation will break any automation still using the old credentials until reconfigured.