Critical Red Hat Quay Flaw Could Expose Private Images and Enable Repository Overwrites
Summary
Red Hat says CVE-2026-123710 can let unauthenticated attackers take over Quay registry token signing, access or overwrite repositories, and persist malicious signing keys. The advisory gives no fixed version.
Key points
- CVE-2026-123710 has a CVSS score of 9.8 and affects Quay deployments where the key-management service is accessible to untrusted clients.
- With anonymous access enabled, an unauthenticated attacker can obtain a registry token and exploit key rotation; Red Hat says valid Quay accounts can exploit the flaw even when anonymous access is disabled.
- An attacker-controlled signing key can generate tokens with read and write access to any repository, potentially exposing private images and secrets or enabling image replacement.
- The malicious key can persist across registry restarts, and its removal may not be sufficient if attackers can reinstall it before a fix is deployed.
- Red Hat recommends restricting access to the key-management service, reviewing logs for suspicious key changes, and removing unauthorized keys; changing passwords or regenerating robot tokens does not invalidate such a key.
- The advisory does not identify a fixed version. Fixes for this flaw and CVE-2026-110697 were merged into the project repository on November 11.
Article Details
- Vulnerability Types
- Registry token-signing key rotation flaw
- Unauthenticated takeover of registry token signing
- Severity
- Critical (CVSS 9.8)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the key-management service.
- Review logs for suspicious key changes and remove unauthorized keys.