Critical Red Hat Quay Vulnerability Allows Attackers to Hijack Token Signing and Access Private Container Images
A critical vulnerability tracked as CVE-2026-123710 with a CVSS score of 9.8 has been identified in Red Hat Quay, an enterprise container registry used to store, manage, and distribute container images. The flaw resides in the service responsible for managing signing keys and allows an unauthenticated attacker to take over registry token signing when the key server is accessible to untrusted clients. Attackers can exploit weaknesses in the key rotation mechanism to install their own trusted signing key, generate tokens with read and write access to any repository, and expose private images along with any stored credentials or secrets. The malicious key can be set without an expiration date and persists across registry restarts, while also interfering with legitimate operations by deleting instance keys. Red Hat warns that disabling anonymous access does not mitigate the risk, as any valid account can still exploit the issue, and recommends restricting access to the key-management service, reviewing logs, and removing unauthorized keys until a fix is deployed.
SecurityWeekNov 12, 2026Translated from English