CVE-2026-105447 — Quay: quay: global read-only superuser can access build trigger write credentials
A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global re…
Published: 2026-10-05 · CVSS: 5.5 · CVSS 3.1
A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7