Vulnerability · Published May 29, 2026 · Assigned by redhat

CVE-2026-10078Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring

Low 2.7

In plain English

A low-severity security flaw in Red Hat Quay 3 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Quay 3	see references
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-598 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2026-10078 vdb-entry, x_refsource_REDHAT
RHBZ#2483168 issue-tracking, x_refsource_REDHAT