Unauthenticated Red Hat Quay flaw lets attackers replace signing keys
Original title: Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries
CVE-2026-123710 scores 9.8; anonymous tokens can install a non-expiring key when anonymous access is on, and no fix is named.
Red Hat published CVE-2026-123710 on November 11, 2026, a CVSS 9.8 flaw in the Quay service key server. A key-rotation request checks that a JWT is signed by an approved key and has the expected audience and issuer, but not that the token was issued for rotation. With FEATURE_ANONYMOUS_ACCESS enabled, an anonymous token from /v2/auth can submit a key to /keys that inherits approval and can have no expiry, letting the attacker sign tokens for any repository, read or write private images and swap tags. Quay 3 and Quay 5 images are affected only where untrusted clients can reach /keys. No patched release is named, and no in-the-wild attacks or indexed public exploit code are reported.
Unconfirmed: Red Hat has not named a fixed version, and absence of indexed exploit code is from one tracker.
- The audience is taken from a client-supplied service parameter, per Red Hat Bugzilla.
- Red Hat credits researcher Dave O’Connor; the logic dates to the first public commit.
- Deleting a rogue key fails until a fixed build, because a new key can be installed.
- Defenders should review service_key_rotate and service_key_delete events with a null expiration_date.
Impact: Forge registry tokens to read, write and retag private images
| Product | Affected |
|---|---|
| Red Hat Quay | Quay 3 and Quay 5 images |
- 1.Limit /keys at the proxy or load balancer to trusted internal components.
- 2.Remove unrecognized approved service keys and keep the /keys block until a patch ships.
- 3.Check audit logs for service_key_rotate and service_key_delete events with a null expiration_date.
- CVEs
- CVE-2026-123710
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123710 | Unauthenticated signing-key install in Red Hat Quay | 9.8 | — |
From the original article
2 min read at cybersecuritynews.com
A critical flaw in Red Hat Quay lets anyone who can reach a registry’s key server take over its token signing. The bug is tracked as CVE-2026-123710 and carries a CVSS score of 9. 8, according to Red Hat’s advisory and the National Vulnerability Database.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.