CVE-2026-10078: Quay Config-Tool Information Disclosure

CVE-2026-10078 Overview

CVE-2026-10078 is an information disclosure vulnerability in the Red Hat Quay config-tool GitLab OAuth validator. The flaw transmits the client_id and client_secret as plaintext URL query parameters in POST requests sent to the GitLab endpoint. Because URL components are routinely captured by server access logs, reverse proxies, and other monitoring systems, these credentials can be persisted across multiple logging layers. An authenticated attacker with access to those logs can recover the OAuth credentials and reuse them for unauthorized access. The issue is tracked under [CWE-598] (Information Exposure Through Query Strings in GET/POST Request).

Critical Impact
Plaintext transmission of GitLab OAuth client_id and client_secret in URL query parameters allows credential disclosure through any log source that records request URLs.

Affected Products

Red Hat Quay config-tool component
Quay deployments configured to use GitLab OAuth authentication
Downstream environments ingesting Quay request URLs into logging or monitoring pipelines

Discovery Timeline

2026-05-29 - CVE-2026-10078 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10078

Vulnerability Analysis

The Quay config-tool validates GitLab OAuth integration by issuing a POST request to the GitLab endpoint. Instead of placing the client_id and client_secret in the request body or an Authorization header, the validator appends them to the request URL as query string parameters. HTTPS protects this data in transit on the wire, but the URL itself is exposed at every endpoint that processes the request. Reverse proxies, load balancers, web application firewalls, ingress controllers, and the GitLab server access logs typically record the full request line, including the query string. Any operator, log aggregator, or attacker with read access to those logs can recover the secrets without breaking transport encryption.

Root Cause

The root cause is improper handling of sensitive credentials in the GitLab OAuth validation routine. The code constructs the validation request using URL query parameters for credentials rather than the HTTP request body. This pattern is classified under [CWE-598], which covers information exposure through query strings. Exploitation requires high privileges to access log data, which limits scope but does not eliminate the risk in shared logging environments.

Attack Vector

Exploitation is passive. An attacker with read access to any log source recording HTTP request URLs from the Quay config-tool, such as web server logs, reverse proxy logs, SIEM ingestion pipelines, or shared observability platforms, can grep for the validator endpoint and extract client_id and client_secret pairs. The recovered credentials can then be used to impersonate the Quay OAuth application against GitLab, enabling unauthorized token issuance and information disclosure from connected GitLab resources.

No public proof-of-concept code is required to reproduce this behavior. The vulnerability manifests through normal use of the configuration validator. Refer to the Red Hat CVE-2026-10078 Advisory and Red Hat Bug Report #2483168 for technical details.

Detection Methods for CVE-2026-10078

Indicators of Compromise

Log entries containing the GitLab OAuth endpoint with client_id= and client_secret= parameters present in the request URL
Unexpected OAuth token issuance from GitLab using the Quay application credentials originating from unfamiliar source addresses
Access patterns to log storage, SIEM indices, or proxy log buckets that correlate with subsequent GitLab API activity

Detection Strategies

Scan historical web server, reverse proxy, ingress, and WAF logs for the validator URL pattern containing query-string credentials, then treat any matched secrets as compromised
Audit GitLab application activity for OAuth grants and API calls outside expected Quay operational windows
Correlate log-store access events with downstream GitLab authentication events to identify potential credential reuse

Monitoring Recommendations

Enable alerting on any request URL containing client_secret= across all logging tiers and route those alerts to a restricted incident channel
Restrict and audit read access to log aggregation systems that may have ingested Quay config-tool traffic
Monitor GitLab audit logs for new personal access tokens or OAuth tokens minted using the Quay application credentials

How to Mitigate CVE-2026-10078

Immediate Actions Required

Rotate the GitLab OAuth client_id and client_secret configured in Quay and invalidate any tokens previously issued through them
Purge or restrict historical log entries that captured the validator URL containing the credentials
Limit access to the Quay config-tool to administrators on trusted networks until a fixed version is deployed

Patch Information

Consult the Red Hat CVE-2026-10078 Advisory for the authoritative list of fixed Quay versions and errata. Track remediation progress through Red Hat Bug Report #2483168.

Workarounds

Avoid using the GitLab OAuth validation feature in the config-tool until the patched release is installed
Configure reverse proxies and ingress controllers to strip or redact client_secret query parameters from access logs
Move log storage for Quay request URLs into an access-controlled tier with mandatory auditing for read operations

bash

# Example nginx directive to redact client_secret from access logs
map $request_uri $sanitized_uri {
    default $request_uri;
    "~*(.*)client_secret=[^&]+(.*)" $1client_secret=REDACTED$2;
}

log_format sanitized '$remote_addr - $remote_user [$time_local] '
                    '"$request_method $sanitized_uri $server_protocol" '
                    '$status $body_bytes_sent';

access_log /var/log/nginx/access.log sanitized;