CVE-2026-10078: Quay GitLab OAuth Credentials Leaked in Plaintext Query Parameters

Technical summary

The vulnerability resides in Quay's config-tool GitLab OAuth validator. The flaw causes OAuth credentials (client_id and client_secret) to be transmitted via URL query parameters in POST requests instead of being placed in the request body or secure headers. Query parameters are routinely logged by infrastructure components including HTTP servers, reverse proxies, WAFs, and security monitoring tools. CWE-598 (Use of GET Request with Sensitive Query Strings) categorizes this improper credential transmission. The CVSS 3.1 score of 2.7 reflects the low attack vector (network-based but requires high privilege to trigger) and limited confidentiality impact when logging access is restricted to privileged users.

Business impact

The primary business risk is credential disclosure through log aggregation and analysis. If an organization centralizes logs from web servers, proxies, or monitoring infrastructure, GitLab OAuth credentials become searchable and extractable by anyone with log access—often a broader group than database administrators. This could enable lateral movement: an attacker with log access could use compromised GitLab credentials to access repositories, CI/CD pipelines, or other GitLab-integrated systems. For regulated environments, plaintext credential logging in audit trails may also create compliance violations.

Affected systems

This vulnerability affects Quay deployments that use GitLab as an OAuth identity provider and are running vulnerable versions of the config-tool. Vendor product data is not provided in the source; verify the specific Quay versions affected against the official Quay security advisory. Environments with centralized logging, log aggregation tools (ELK, Splunk, CloudWatch), or security information and event management (SIEM) systems are at higher risk of credential exposure.

Exploitability

Exploitation requires high privileges (administrator or log-access role) as indicated by the CVSS vector. The attacker must be able to observe or access logs containing the POST request. This is not a remote code execution or unauthenticated attack; instead, it creates a credential disclosure risk for operators and log administrators. The attack does not require user interaction and depends only on normal GitLab OAuth configuration workflow.

Remediation

The vendor must release an updated config-tool that transmits OAuth credentials in the POST body or via secure headers rather than query parameters. Organizations should apply the patched version when available. Interim mitigations include restricting log retention and access for sensitive infrastructure logs, redacting query parameters in log pipelines, and using network segmentation to limit who can access logs containing this data.

Patch guidance

Verify against the official Quay security advisory for patched config-tool versions. Patch testing should include verifying that GitLab OAuth configuration still functions correctly after upgrade and that credential materials no longer appear in access logs. After patching, consider log rotation to purge any historical logs containing exposed credentials.

Detection guidance

Search existing logs for POST requests to GitLab OAuth endpoints (typically /oauth/authorize or similar) containing 'client_id' or 'client_secret' in the query string. Check reverse proxy, web server, WAF, and SIEM logs for these patterns. If found, assume credentials may be compromised and initiate GitLab OAuth credential rotation. Monitor Quay's config-tool upgrade status and scan running instances to confirm they are running patched versions.

Why prioritize this

Despite the low CVSS score, this merits prompt attention for organizations using GitLab OAuth with Quay. The risk is conditional on log access, but in many enterprises, log repositories are accessed by security teams, DevOps engineers, and contractors. The attack surface is largely determined by organizational log management practices rather than the vulnerability's technical complexity. Prioritize patching for environments with broad or insufficiently restricted log access.

Risk score, explained

CVSS 3.1 assigns a score of 2.7 (LOW) based on: Attack Vector (Network) indicating remote trigger capability, Attack Complexity (Low) meaning no special conditions required for exploitation, Privileges Required (High) restricting the threat actor to high-privilege roles, no User Interaction required, and Confidentiality Impact (Low) limited to credential exposure rather than mass data theft. The score reflects the requirement for prior high privilege access to exploit the vulnerability. Organizations should not assume 'low' severity means 'low priority'; credential compromise can have outsized impact depending on role and environment.

Frequently asked questions