Critical Red Hat Quay Vulnerability Enables Unauthorized Access and Manipulation of Private Container Images
A critical vulnerability identified as CVE-2026-123710 affects Red Hat Quay, an enterprise container registry, enabling unauthenticated attackers to intervene in token signing and thereby gain read and write access to private container image repositories. This flaw is exploitable when the key management service is accessible to untrusted clients and anonymous access is enabled, allowing attackers to install persistent malicious signing keys that bypass normal access controls and survive registry restarts. The vulnerability also disrupts normal operations by deleting legitimate keys upon rotation. Red Hat recommends restricting access to the key management service and monitoring for signs of unauthorized key changes, though a full fix is pending as patches were only merged into the project's GitHub repository on November 11, 2026. Changing passwords or regenerating robot tokens does not mitigate the threat posed by this vulnerability.
Entenda a falha
A vulnerabilidade
CVE-2026-123710 (CVSS 9.8) is a critical flaw in the service key server of Red Hat Quay, the enterprise container registry. It affects deployments where the key-management service is reachable by untrusted clients. An unauthenticated attacker can take over registry token signing and gain read and write access to every repository, including private ones. The articles name no fixed version: patches were only merged into the project's GitHub repository on November 11, and neither the advisory nor the Bugzilla report gives a fixed release.
Como funciona
With anonymous access enabled, a client with no account can obtain a registry token. It then uses weaknesses in the key rotation mechanism of the key service to register its own signing key as trusted. The registry accepts tokens signed with that key and grants read and write access to any repository. The key can be set without an expiration date and survives restarts. Rotation also deletes the legitimate instance key, and the attacker's key can delete replacement instance keys, which disrupts pushes and pulls.
Por que é vulnerável
The articles describe the root cause only as weaknesses in the key rotation mechanism of the service key server, which let an unauthorized party install a trusted signing key. They do not detail the missing check, nor say why it went unnoticed or how the patch changes the code. Red Hat notes that changing passwords or regenerating robot tokens does not invalidate the rogue key, so the trust persists in the key store rather than in user credentials.
Onde está
The flaw is in Red Hat Quay's service key server and its key rotation mechanism; no file or function is named, and the fixes were merged into the project's GitHub repository on November 11.
Como foi descoberta
According to SecurityWeek, the flaw was discovered by Red Hat's Dave O'Connor. Red Hat published an advisory and a Bugzilla report, and SecurityWeek covered it on November 12. The fixes for this flaw and for another Quay flaw, CVE-2026-110697, were merged on GitHub on November 11. The articles do not say how it was found or when it was reported. They do not report exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 07:16.
Linha do tempo
-
Critical Red Hat Quay Vulnerability Enables Unauthorized Access and Manipulation of Private Container Images
ler a análise desta fonte ocultar
A critical vulnerability identified as CVE-2026-123710 affects Red Hat Quay, an enterprise container registry, enabling unauthenticated attackers to intervene in token signing and thereby gain read and write access to private container image repositories. This flaw is exploitable when the key management service is accessible to untrusted clients and anonymous access is enabled, allowing attackers to install persistent malicious signing keys that bypass normal access controls and survive registry restarts. The vulnerability also disrupts normal operations by deleting legitimate keys upon rotation. Red Hat recommends restricting access to the key management service and monitoring for signs of unauthorized key changes, though a full fix is pending as patches were only merged into the project's GitHub repository on November 11, 2026. Changing passwords or regenerating robot tokens does not mitigate the threat posed by this vulnerability.