Quay signing flaw lets attackers mint registry-wide tokens
Red Hat disclosed CVE-2026-123710, a critical Red Hat Quay flaw rated 9.8, that lets attackers forge registry tokens with read/write access across repositories. It affects deployments where the key-management service is reachable by untrusted clients; even with anonymous access disabled, any valid Quay account can exploit it.
Quay accepts access tokens signed by keys managed by its key service. A weakness in key rotation lets an attacker install a signing key Quay trusts, then create tokens with permissions to read or modify any repository. The attacker’s key can survive restarts and password changes or robot-token resets do not revoke it; Red Hat says attackers may reinstall it until a fix is deployed.
For teams that publish or deploy from Quay, this is a compromise of the registry’s trust root: private images may be exposed, and replaced images may flow into downstream build and deployment pipelines. Red Hat says fixes were merged on November 11, but named no fixed release, so the report does not establish which releases are protected.