CVE-2026-110697 Remediation and Misuse Identification for Red Hat Quay and Quay.io

Issue

The CVE introduced 3 separate attack vectors. Namespaces containing a single character match to _ could gain the following over the matching namespace:

1. List their robot accounts and their tokens which could be used to access and overwriting existing images or push new images

2. Deletion of the namespace containing the underscores also deletes all of the robot accounts in the matching namespace, potentially disrupting access other systems that used these tokens to interact with your images

3. Changing the name of the namespace containing the underscores also changes the namespace prefix of the matching namespace. For example changing the namespace name “m_tch” to “changed” will also update every robot account in the matching namespace with that same prefix. (e.g. match+robotaccount -> changed+robotaccount)

• The robot accounts will no longer be listed in the matching namespace
• Permissions that the robot account had are lost
• If the token is regenerated for that robot account it will not be able to authenticate
• Changing the name of organizations can only be done by superusers via the superuser panel or API
• Changing the name of users is only possible by enabling FEATURE_USER_RENAME which defaults to false