Quay token theft via SQL wildcard injection in robot listing

Description

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.

Reported fixed versions

3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9