CVE-2026-10078
Low · 2.7CVSS
2.7
EPSS
0.2%
Published
May 29, 2026
CISA due date
—
The record
A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113669 ApostropheCMS is an open-source Node.js content management system. CWE-598
- CVE-2026-61614 SolidInvoice is an open-source invoicing platform. CWE-598
- CVE-2026-82181 Medical Practice Management System developed by Le-yan has a Sensitive Data in URL… CWE-598
- CVE-2026-76179 An improper protection of authentication tokens vulnerability exists in certain Ebyte… CWE-598
- CVE-2026-63408 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-598
- CVE-2026-74880 openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in… CWE-598
- CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the… CWE-598
- CVE-2026-14838 Use of GET request method with sensitive query strings vulnerability in Bilin Software… CWE-598