A significant security vulnerability has been identified in Red Hat Quay, allowing attackers to access and modify private container images in any registry repository. This flaw, tracked as CVE-2026-123710 with a CVSS score of 9.8, poses a severe risk to cloud security infrastructure.
Details of the Red Hat Quay Flaw
Red Hat Quay, known for enabling anonymous access by default, can be exploited by attackers without an account. Even when this feature is disabled, any valid account holder can still leverage the flaw, as confirmed by Red Hat’s recent advisory. The company has issued updates for eight branches of Quay 3 to address this issue.
The vulnerability arises from Quay’s reliance on trusted keys to sign access tokens. Attackers can introduce their own keys, which Quay accepts indefinitely, allowing unauthorized access to repositories. This breach enables attackers to extract private images, secrets, and credentials, as well as overwrite existing images, affecting all systems that subsequently pull these images.
Impact and Exploitation Mechanism
The exploit involves manipulating Quay’s key server, which inadequately verifies requests to replace keys. Attackers can utilize tokens signed by trusted keys without appropriate authorization checks. This oversight allows the attacker to delete legitimate keys, disrupting normal operations by causing authentication failures.
A second vulnerability, CVE-2026-110697 with a CVSS score of 9.9, was also disclosed. It allows a Quay user to hijack robot account tokens and manipulate other tenants’ images, exploiting a flaw in the namespace pattern matching process.
Mitigation Strategies and Future Outlook
Red Hat suggests several measures to mitigate these vulnerabilities. Blocking the /keys endpoint to untrusted entities, auditing logs for suspicious key activity, and removing unrecognized service keys are recommended. Importantly, installing updated releases is critical to preventing further exploitation.
The company emphasizes that disabling anonymous access does not fully protect against these risks. Affected systems include standalone installations and those integrated with OpenShift. The advisories highlight the need for ongoing vigilance and timely updates to maintain security integrity.
Looking forward, Red Hat’s upstream fix introduces stricter key management protocols and improved token validation processes. These changes aim to prevent unauthorized key usage and safeguard against similar vulnerabilities in the future.
