Red Hat Quay flaw lets attackers plant their own signing key and read or overwrite private container images

What happened

On 11 November 2026 Red Hat disclosed two critical vulnerabilities in Red Hat Quay, the container image registry that organizations run standalone, on OpenShift (Quay Operator) or as the mirror registry for Red Hat OpenShift in disconnected installs. Both were found by Dave O'Connor of Red Hat.

• CVE-2026-123710: unauthenticated takeover of the registry's signing keys, CVSS 3.1 9.8 (CWE-1287). The attacker can mint tokens for any repository, read private images and replace tags.
• CVE-2026-110697: robot account tokens leak across organizations through an unescaped SQL LIKE pattern, CVSS 3.1 9.9 (CWE-89). Requires an account that may create organizations.

As of 12 November Red Hat lists no fixed build for CVE-2026-123710 (status "Affected", Bugzilla entry still open) and recommends interim mitigations. Yet a single upstream commit in the Quay source fixes both flaws.

Technical details

CVE-2026-123710: service key rotation. Quay signs registry tokens with service keys and manages them through the /keys endpoint (the keyserver). According to Red Hat, the endpoint only checks that the caller's token is signed by an already approved key and carries the expected audience and issuer. It does not check that the token is a rotation credential. An anonymous token that anyone can request from /v2/auth therefore passes, and the client could pick that token's audience itself. The installed key inherits approval and can have no expiry. Quay then accepts tokens signed with it for any repository.

The upstream fix in quay/quay takes the token audience from server configuration instead of the request, requires a rotation claim bound to the specific key, rejects tokens that carry access grants, makes expiry mandatory and capped at the signing key's own expiry, and scopes key changes to the owning service.

CVE-2026-110697: robot listing. The function that lists an organization's robot accounts builds a SQL LIKE pattern from the namespace name without escaping wildcards. In LIKE, an underscore matches any single character, so a namespace called ab_c also matches another tenant's abxc. The attacker gets that tenant's robots and their decrypted tokens, and with them the ability to read, push and overwrite images. Red Hat flags the risk to CI/CD pipelines and the container supply chain.

Red Hat has not published proof-of-concept code and we do not describe the attack steps.

Who is affected

Red Hat says CVE-2026-123710 affects standalone installs (Podman, Docker), Quay deployed by the Operator on OpenShift, the mirror registry for Red Hat OpenShift, and any instance reachable by untrusted clients, internal registries included. Turning off anonymous access does not help: anyone with a valid account can then exploit the flaw.

How to tell if you were compromised

Red Hat recommends:

• Search the Quay audit log for service_key_rotate and service_key_delete events with an empty expiry (expiration_date null).
• Review the list of approved service keys for anything unknown or non-expiring.
• Symptoms Red Hat mentions: pushes or pulls suddenly fail with "authentication required" or "unauthorized" even though credentials have not changed.

From our own practice: compare the digests of production tags with what your CI actually built, and review requests to /keys and /v2/auth in your proxy logs. Our IOC extractor pulls addresses out of logs and runs entirely in your browser. For CVE-2026-110697, look for organizations with an underscore in the name that match another organization when the underscore is treated as any character.

What to do

1. Block /keys now at the proxy or load balancer and allow only the internal components that actually rotate keys (Red Hat's advice).
2. Review the audit log and delete unknown approved keys. Deletion is not lasting until a fixed build is running: without step 1 the attacker can reinstall the key. Password changes and new robot tokens do not revoke a rogue key.
3. Upgrade Quay 3 to the fixed release for your line (3.9.28 to 3.18.3, see the table). Red Hat says these fix CVE-2026-110697. Check the release notes or the CVE page to see whether they also fix CVE-2026-123710. As of 12 November Red Hat does not say so, so keep the step 1 restriction in place until it does.
4. Until you upgrade, restrict who can create organizations with an underscore in the name, and rotate robot tokens for organizations whose names could collide (Red Hat).
5. If you find a rogue key, treat the images in the registry as untrusted: verify digests and signatures (for example with cosign) against your CI output and rebuild anything that does not match.

You can break down the scores in our CVSS calculator.

Timeline

Updates

• 12 Nov 2026 – first version of this article.