Red Hat Quay flaw lets unauthenticated attackers seize registry signing keys
Original title: Critical Red Hat Quay Vulnerability Allows Hackers to Hijack Private Container Registries
CVE-2026-123710 scores 9.8; Red Hat has published no fixed version, and Bugzilla still marks remediation unfinished.
Red Hat disclosed CVE-2026-123710, an unauthenticated flaw in Quay that can let an attacker take over a registry signing key through service key rotation. With that key, an attacker could pull private images or push tampered images under trusted tags. The advisory, published November 11 and updated November 12, names no fixed version, and Bugzilla still lists the bug as NEW with affected versions unspecified.
Unconfirmed: No fixed version had been published at the time of writing, and affected versions remain unspecified.
- Red Hat rates the issue Critical, with a CVSS v3 score of 9.8.
- An unauthenticated client can obtain an anonymous token with an audience it controls.
- Bugzilla 2568072 was opened November 6 at urgent priority and severity.
- Administrators should restrict Quay exposure and pin images by digest until a patch ships.
Impact: take over signing keys and trust private images
| Product | Affected |
|---|---|
| Red Hat Quay | — |
- 1.Limit Quay endpoints to trusted networks and required clients.
- 2.Review registry and authentication logs for unexpected tokens or key changes.
- 3.Pin images by digest and audit recent pushes until a patch ships.
- CVEs
- CVE-2026-123710
- Vendors
- Red Hat
- Products
- Red Hat Quay
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123710 | Unauthenticated signing-key install in Red Hat Quay | 9.8 | — |
From the original article
2 min read at gbhackers.com
Red Hat has announced a critical vulnerability in Red Hat Quay that may allow unauthenticated attackers to take over a registry’s signing key, thereby gaining control over private container images. This vulnerability is tracked as CVE-2026-123710 and has a CVSS v3 score of 9. 8, which Red Hat categorizes as Critical.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.