Vulnerabilities · 13h ago

Quay signing flaw lets attackers mint registry-wide tokens

Red Hat disclosed CVE-2026-123710, a critical Red Hat Quay flaw rated 9.8, that lets attackers forge registry tokens with read/write access across repositories. It affects deployments where the key-management service is reachable by untrusted clients; even with anonymous access disabled, any valid Quay account can exploit it.

Quay accepts access tokens signed by keys managed by its key service. A weakness in key rotation lets an attacker install a signing key Quay trusts, then create tokens with permissions to read or modify any repository. The attacker’s key can survive restarts and password changes or robot-token resets do not revoke it; Red Hat says attackers may reinstall it until a fix is deployed.

For teams that publish or deploy from Quay, this is a compromise of the registry’s trust root: private images may be exposed, and replaced images may flow into downstream build and deployment pipelines. Red Hat says fixes were merged on November 11, but named no fixed release, so the report does not establish which releases are protected.

CVE-2026-123710

NVD KEV

CVSS 9.8 CRITICAL: a flaw was found in Red Hat Quay.

Timeline

Nov 12 Reported by The Hacker News

Sources

2 sources covering this story

The Hacker News Nov 12
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
Red Hat patches two critical Quay flaws enabling registry-wide image access and cross-tenant robot token theft under different prerequisites.
SecurityWeek Nov 12
Critical Red Hat Quay Vulnerability Could Expose Private Container Images
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.

Entities

CVE-2026-123710

Part of the PlainSec briefing for 2026-11-13

Editions

Vulnerabilities · 13h agoQuay signing flaw lets attackers mint registry-wide tokensRed Hat disclosed CVE-2026-123710, a critical Red Hat Quay flaw rated 9.8, that lets attackers forge registry tokens with read/write access across repositories. It affects deployments where the key-management service is reachable by untrusted clients; even with anonymous access disabled, any valid Quay account can exploit it.Quay accepts access tokens signed by keys managed by its key service. A weakness in key rotation lets an attacker install a signing key Quay trusts, then create tokens with permissions to read or modify any repository. The attacker’s key can survive restarts and password changes or robot-token resets do not revoke it; Red Hat says attackers may reinstall it until a fix is deployed.For teams that publish or deploy from Quay, this is a compromise of the registry’s trust root: private images may be exposed, and replaced images may flow into downstream build and deployment pipelines. Red Hat says fixes were merged on November 11, but named no fixed release, so the report does not establish which releases are protected.