Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-18255 A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an… https://www.cve.org/CVERecord?id=CVE-2026-18255
Post summary
A flaw in Quay allows privileged users to view robot account tokens for repositories they do not belong to, exposing sensitive authentication information.
CVE-2026-18255 Unauthorized Robot Account Token Disclosure in Quay Global Read-Only Super Users https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-18255
Post summary
The text briefly announces CVE-2026-18255 as an unauthorized token disclosure in Quay but provides no additional technical, exploitation, or mitigation details.