A pair of critical vulnerabilities in Red Hat Quay allows attackers who can reach a registry instance to read and overwrite private container images in every repository without elevated privileges.
The first flaw, tracked as CVE-2026-123710 (CVSS 9.8), exploits Quay’s trusted-key mechanism for signing access tokens. An attacker can add an attacker-controlled key with no expiration date; Quay then accepts tokens signed by that key for any repository. The planted key survives restarts and can also be used to delete legitimate keys, causing authentication failures for normal operations. The vulnerability has existed since Quay’s first public commit and affects standalone installs, Quay Operator deployments on OpenShift, and the mirror registry for Red Hat OpenShift.
Quay’s key server fails to verify that a key-replacement request carries a token specifically issued for rotation. An anonymous token obtained from the /v2/auth endpoint satisfies the checks because Quay itself signs it and the caller controls the audience claim. Red Hat advises blocking the /keys endpoint at the proxy or load balancer for all but trusted internal components and searching audit logs for service_key_rotate and service_key_delete events where expiration_date is null.
Second flaw enables namespace-based token theft
A second critical issue, CVE-2026-110697 (CVSS 9.9), resides in the code that lists robot accounts. The namespace name is used to build an SQL LIKE pattern without escaping wildcard characters. Because an underscore matches any single character in SQL LIKE, a carefully chosen namespace can match another tenant’s namespace and return its robot accounts together with their decrypted tokens.
The attacker needs no special privileges, and the victim tenant performs no action. When Quay serves as the integrated registry for OpenShift, stolen robot credentials can be used to inject malicious images into CI/CD pipelines. Deleting the attacker’s namespace also removes the corresponding robot accounts, potentially disrupting dependent systems.
Red Hat released fixed builds for eight Quay 3 branches. The upstream patch adds the missing rotation check, forces expiry dates on keys added via the key server, prevents callers from choosing token audience, and corrects the robot-account search logic. Until patches are deployed, organizations should limit creation of organizations or namespaces containing underscores, rotate robot tokens for any namespace matching an underscore pattern, and monitor for anomalous pull or push activity.
