THE CRUNCH
A critical vulnerability in Red Hat Quay, the enterprise container registry used to store and distribute container images, could let an unauthenticated attacker take over registry token signing and gain read and write access to any repository. The flaw, tracked as CVE-2026-123710 and scored 9.8 on the CVSS scale, affects deployments where the service managing signing keys is reachable by untrusted clients. Red Hat says an attacker who installs their own trusted signing key can then generate tokens that bypass normal access restrictions, exposing private images and any credentials or secrets stored inside them, and overwriting images that other systems later download.
The malicious key can be set with no expiration date and survives registry restarts unless someone removes it. Red Hat's Bugzilla report explains that the rotation process also deletes the legitimate instance key as a side effect, and the attacker's key can delete any replacement keys, potentially blocking legitimate users from uploading or downloading images.
Two pieces of Red Hat guidance are worth flagging. Turning off anonymous access does not help, because any valid Quay account can still exploit the flaw. Changing passwords or regenerating robot tokens also does not invalidate an unauthorised signing key.
Red Hat recommends restricting access to the key-management service, reviewing logs for suspicious key changes and removing unauthorised keys, but warns attackers could reinstall malicious keys until a fix ships. No fixed version is named yet, though fixes for this flaw and a second Quay vulnerability, CVE-2026-110697, were merged into the project's GitHub repository on November 11. The flaw was found by Red Hat's Dave O'Connor.