Critical Red Hat Quay Vulnerability Could Expose Private Container Images

A critical vulnerability in Red Hat Quay could allow attackers to access private container images and replace content in repositories across an affected registry.

Red Hat Quay is an enterprise container registry used to store, manage and distribute container images. It allows organizations to control who can download or upload images used in application development and deployment.

The vulnerability, tracked as CVE-2026-123710, has a CVSS score of 9.8. It affects deployments where the service responsible for managing signing keys is accessible to untrusted clients.

“This Critical flaw in Red Hat Quay’s service key server allows an unauthenticated attacker to take over registry token signing,” Red Hat said in its advisory .

When anonymous access is enabled, an attacker without an account can obtain a registry token and exploit weaknesses in the key rotation mechanism to install their own trusted signing key.

The attacker can then generate tokens granting read and write access to any repository, bypassing normal access restrictions. This could expose private images and any credentials or other secrets stored in them, while also allowing attackers to overwrite images that other systems subsequently download.

The malicious signing key can be configured without an expiration date and survives registry restarts unless removed.

“Rotation also deletes the legitimate instance key as a side effect, and the attacker key can delete replacement instance keys,” Red Hat’s Bugzilla report explains.

This could interfere with normal registry operations, preventing legitimate users from uploading or downloading images.

“Turning off anonymous access doesn’t protect you, because any valid Quay account can still exploit the flaw,” Red Hat warns in additional guidance.

The company also notes that changing passwords or regenerating robot tokens does not invalidate an unauthorized signing key.

Red Hat recommends restricting access to the key-management service, reviewing logs for suspicious key changes, and removing unauthorized keys. However, the company warns that attackers could reinstall malicious keys until a fix is deployed.

The vulnerability was discovered by Red Hat’s Dave O’Connor.

Neither the advisory nor the Bugzilla report identifies a fixed version. However, fixes for this vulnerability and another Quay flaw tracked as CVE-2026-110697 were merged into the project’s GitHub repository on November 11.

Related : Critical Xen Orchestra Flaws Exploited in Attacks

Related : Asus, Zoom Release Security Patches

Related : Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD

Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms

Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

Adobe Patches 110 Vulnerabilities Across 9 Products

Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

Notion Customer Data Compromised in Fireworks AI Hack

Hackers Deploy Malware in Fresh ScreenConnect Campaign

Hackers Target N-central Zero-Days as N-able Rushes Patches

Maersk Confirms Data Theft Amid $5 Million Extortion Attempt

Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online

Critical Xen Orchestra Flaws Exploited in Attacks

Asus, Zoom Release Security Patches

Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities

Flipboard Whatsapp Whatsapp Email