A flaw in the configuration tool used by Red Hat Quay causes the GitLab OAuth client credentials to be sent as plain text in the URL query string of a POST request. Because these query parameters are logged by web servers, reverse proxies, and other monitoring systems, the client_id and client_secret become exposed in log files, allowing an attacker who can read those logs to obtain the credentials and potentially use them for unauthorized access. This flaw is an example of CWE-598, representing the weakness of exposing secrets in logable data.

Red Hat Quay version 3, specifically the Quay config-tool component, is affected. The vulnerability exists in any installation that uses the GitLab OAuth validator as provided in the Red Hat Quay 3 distribution.

The CVSS score of 2.7 indicates low severity, but the vulnerability can lead to credential theft if log files are accessible. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited in the wild. The likely attack vector is any entity that can read the logs where the request URLs are stored, which may include local administrators, compromised hosts, or network observers. If an attacker can retrieve the logs, they can obtain the exposed credentials and use them to access the GitLab account or services tied to those credentials.