A significant security flaw has been identified in Red Hat Quay, potentially allowing unauthorized individuals to access and modify private container images within affected registries. This vulnerability could have severe implications for organizations relying on Red Hat Quay to manage their container images.
Understanding Red Hat Quay and Its Functions
Red Hat Quay serves as an enterprise-grade container registry, facilitating the storage, management, and distribution of container images. It empowers organizations by enabling control over who can upload and download images, which are crucial for application development and deployment.
The vulnerability, labeled as CVE-2026-123710, has been assigned a CVSS score of 9.8, indicating its critical nature. It specifically impacts setups where the key management service is exposed to untrusted users.
Exploiting the Vulnerability
According to Red Hat’s advisory, this flaw permits attackers to take control of the registry token signing process without needing authentication. When anonymous access to the registry is enabled, an attacker can acquire a token and exploit weaknesses in the key rotation mechanism to introduce a trusted signing key.
With this malicious signing key, attackers can generate tokens that allow both read and write access to any repository, bypassing standard access controls. This breach could lead to the exposure of sensitive private images and confidential data stored within them. Furthermore, attackers can overwrite images that other systems may subsequently download.
Mitigation and Future Outlook
Red Hat advises restricting access to the key-management service and closely monitoring logs for any unusual key changes. Additionally, unauthorized keys should be removed promptly. However, the company cautions that attackers may continue to reinstall malicious keys until a permanent fix is implemented.
Dave O’Connor of Red Hat uncovered this vulnerability. While no fixed version has been announced in the advisory or Bugzilla report, patches for this flaw and another vulnerability, CVE-2026-110697, have been integrated into the project’s GitHub repository as of November 11.
For organizations using Red Hat Quay, it is crucial to stay informed about updates and apply security patches promptly to safeguard their container images and maintain the integrity of their operations.
