Project Quay vulnerabilities
We track 2 vulnerabilities in Project Quay products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
2vulnerabilities
2critical
0high
0exploited
9.9average CVSS score
Latest Project Quay vulnerabilities
- 9.9 Critical severity
quay: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and
- 9.8 Critical severity
quay: Improper Validation of Specified Type of Input
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens s