Red Hat Quay Unauth Token Abuse Leads to Arbitrary Key Injection
CVE-2026-123710 Published on November 11, 2026
Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
Vulnerability Analysis
CVE-2026-123710 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Timeline
Reported to Red Hat.
Made public. 5 days later.
Weakness Type
Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Products Associated with CVE-2026-123710
Want to know whenever a new CVE is published for Red Hat Quay? stack.watch will email you.
Affected Versions
Red Hat Quay 3: Red Hat Quay 3: Red Hat Quay 5:Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.