CVE-2026-10078
Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
8th
A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.
| CWE | CWE-598 |
| Vendor | red hat |
| Product | red hat quay 3 |
| Published | May 29, 2026 |
| Last Updated | May 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat quay 3
Be the first to know when new low vulnerabilities affecting red hat red hat quay 3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Red Hat / Red Hat Quay 3
All versions affected Red Hat / Red Hat Quay 3
All versions affected References
Credits
Red Hat would like to thank Martin Brodeur for reporting this issue.