A critical vulnerability identified in Red Hat Quay poses a significant threat to container registries worldwide. Tracked as CVE-2026-123710, this flaw has been assigned a high severity rating with a CVSS score of 9.8, as per Red Hat’s latest advisory and the National Vulnerability Database. The issue was officially disclosed on November 11, 2026.
Understanding the Red Hat Quay Flaw
Red Hat Quay serves as an enterprise-level container registry responsible for storing and distributing container images. The discovered vulnerability exists within its service key server. When the server attempts to rotate a signing key, it merely verifies that the JWT is signed by an approved key, without assessing whether the token is actually suitable for key rotation.
This oversight allows an attacker with an anonymous token from the /v2/auth endpoint to manipulate the system. As detailed in Red Hat’s Bugzilla report, the audience parameter can be controlled by the attacker, especially when the FEATURE_ANONYMOUS_ACCESS setting is enabled.
Potential Impact on Container Registries
With unauthorized access, an attacker can introduce their own key via the /keys endpoint, which Quay accepts and trusts immediately. This action grants the attacker the ability to issue registry tokens for any repository, risking unauthorized read and write access to private images, and the capability to alter repository tags.
The exposure of private images can lead to significant security breaches, as these images often contain sensitive information. Furthermore, altered tags can compromise build systems by introducing malicious images, a vulnerability reminiscent of past incidents involving other container registries like Gitea.
Mitigation Strategies and Future Precautions
Red Hat has pinpointed Quay versions 3 and 5 as susceptible, with the vulnerability affecting systems where /keys is accessible to untrusted clients. To mitigate the risk, Red Hat suggests restricting access to /keys via proxy or load balancer configurations, limiting it to trusted internal components. Additionally, audit logs should be examined for suspicious service_key_rotate and service_key_delete events.
While removing unauthorized keys provides temporary relief, the vulnerability persists until a patched version is released. Red Hat advises maintaining the /keys block and closely monitoring their advisories for updates on a fixed release. No attacks exploiting this vulnerability have been reported yet, and there is no known public exploit code, but the simplicity of the attack procedure necessitates urgent attention.
Given the pivotal role of registries in software delivery, a compromised signing key could jeopardize the integrity of all stored images. Organizations utilizing Quay are encouraged to review our guide on container registry security tools to bolster their defenses.
