Critical Red Hat Quay Vulnerability Could Expose Private Container Images

Red Hat has disclosed a critical flaw in Quay, its enterprise container registry, tracked as CVE-2026-123710 with a CVSS score of 9.8. The bug lies in the service that manages signing keys: when this component is reachable by untrusted clients or anonymous access is enabled, an attacker can obtain a registry token and abuse the key-rotation process to install a forged, trusted signing key. With that key, the attacker can mint tokens granting full read and write access to any repository on the registry, exposing private container images (and any secrets embedded in them) and allowing malicious overwrites of images later pulled by other systems. Red Hat notes the rogue key can be set to never expire, survives restarts, and that disabling anonymous access or rotating credentials does not remove the threat, since any valid account can trigger the exploit and legitimate keys may get deleted in the process. No patched version has been published yet, though fixes for this issue and a related flaw, CVE-2026-110697, were merged into Quay's GitHub repo on November 11; in the meantime Red Hat advises locking down access to the key-management service and auditing for unauthorized keys.