CVE-2026-123710

Think of this registry like a locked warehouse that stores your company's software "shipping containers." This flaw is like a flaw in the loading-dock's key-cutting machine: someone outside the warehouse, without ever showing ID, could cut themselves a master key that the warehouse staff will trust forever. With that key they could peek inside private containers or swap out the contents for something else.

This matters to you if you run Red Hat Quay 3 or Red Hat Quay 5 as your private container image registry, whether self-hosted or managed. It applies regardless of whether an attacker has an account — the flaw works with an anonymous, self-issued token. It's only a real risk if your Quay instance's API is reachable from the internet or from an untrusted network.

This is a serious, critical-severity flaw, but there are currently no confirmed real-world attacks and no public exploit code circulating, so this sits at an elevated-but-not-emergency level. Treat it as a priority to track closely and patch as soon as Red Hat releases a fix, rather than an active fire to fight tonight.

1. Inventory all Red Hat Quay 3 and Quay 5 deployments and confirm network reachability of the registry API, particularly the service key rotation endpoint. 2. Monitor Red Hat's security advisory channel for CVE-2026-123710 — as of now there is no published fixed version, so there is no upgrade path to recommend yet. 3. As an interim mitigation, restrict/firewall access to the Quay API and service key rotation endpoint to trusted internal networks or VPN only, since the attack requires network reachability and no prior authentication. 4. Audit existing approved signing keys in your Quay instance for any unexpected or non-expiring keys that may already have been installed. 5. Once Red Hat issues a fix, upgrade promptly and re-verify signing key inventory. This CVE is not in CISA's KEV catalog, so there is no federally mandated remediation deadline, but given the CVSS 9.8 rating this should be tracked at high priority internally.

CVSS 3.1 score is 9.8 (Critical: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity, and availability with no privileges or user interaction required. The weakness is CWE-1287 (improper validation of specified type of input / improper authentication logic) in the service key rotation flow, allowing an attacker to self-mint an anonymous registry token with a controlled audience, present it to install an attacker-controlled signing key with no expiry, and have subsequently-signed tokens trusted registry-wide. Exploitation is not confirmed in the wild, is not listed in CISA KEV, and no public exploit code exists; predicted likelihood of near-term exploitation is low and stable. No fix/patch is currently published for either affected branch, so remediation is limited to network-level mitigations until Red Hat releases an update.