Critical Red Hat Quay flaw can expose and overwrite private images
Original title: Critical Red Hat Quay Vulnerability Could Expose Private Container Images
CVE-2026-123710 scores 9.8; any valid account can install a persistent signing key, and no fixed version is named.
Red Hat says a critical flaw in Quay’s service key server, CVE-2026-123710, lets an attacker take over registry token signing when that service is reachable by untrusted clients. With a forged trusted key, the attacker can mint tokens for read and write access to any repository, exposing private images and secrets and overwriting images others later pull. Disabling anonymous access does not stop a valid account from exploiting it, and the malicious key survives restarts and secret rotation. Fixes were merged on November 11, but no fixed version is identified.
Unconfirmed: Neither the advisory nor the Bugzilla report names a fixed version, and exploitation is not discussed.
- Red Hat rates CVE-2026-123710 at CVSS 9.8.
- Changing passwords or regenerating robot tokens does not remove an unauthorized signing key.
- Key rotation deletes the legitimate instance key as a side effect.
- Fixes for CVE-2026-123710 and CVE-2026-110697 were merged on November 11.
- Red Hat’s Dave O’Connor discovered the vulnerability.
Impact: Read and write any repository, including private images and secrets
| Product | Affected |
|---|---|
| Red Hat Quay | — |
- 1.Restrict access to the Quay key-management service.
- 2.Review logs for suspicious key changes and remove unauthorized keys.
- 3.Deploy the fix; Red Hat says attackers can reinstall keys until then.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110697 | SQL wildcard injection in Quay robot account listing | 9.9 | — | ||
| CVE-2026-123710 | Unauthenticated signing-key install in Red Hat Quay | 9.8 | — |
From the original article
2 min read at securityweek.com
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access. The post Critical Red Hat Quay Vulnerability Could Expose Private Container Images appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.