Unauthenticated Red Hat Quay flaw lets attackers replace signing keys
CVE-2026-123710 scores 9.8; anonymous tokens can install a non-expiring key when anonymous access is on, and no fix is named.
78
CVE-2026-123710
Unauthenticated signing-key install in Red Hat Quay
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Red Hat Quay lets an unauthenticated client get an anonymous registry token with an audience it chooses and present that token to the service key-rotation endpoint. The client can install its own approved signing key with no expiry. Tokens signed with that key are accepted for any repository, giving read and write access to private images and the ability to replace repository tags.
What to do: Apply Red Hat's update for CVE-2026-123710. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Red Hat Quay | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
In the news
4 storiesCritical Red Hat Quay flaws expose private container images
CVE-2026-123710 and CVE-2026-110697 let attackers read or overwrite images; anonymous access can be enough.
74
Red Hat Quay flaw lets unauthenticated attackers seize registry signing keys
CVE-2026-123710 scores 9.8; Red Hat has published no fixed version, and Bugzilla still marks remediation unfinished.
72
Critical Red Hat Quay flaw can expose and overwrite private images
CVE-2026-123710 scores 9.8; any valid account can install a persistent signing key, and no fixed version is named.
68