---
title: Red Hat Quay CVE-2026-123710 (9.8): an unauthenticated client can install its own registry signing key and pull or overwrite any private image; no fixed build yet | ctxsec
url: https://ctxsec.com/items/red-hat-quay-cve-2026-123710-unauthenticated-signing-key-takeover-no-fixed-build
description: "Red Hat says a flaw in Quay's service key server lets an attacker install an approved, never-expiring signing key and then forge registry tokens for any repository, including other organizations' private repositories. With anonymous access on (the default) no account is needed; turning it off doesn't help because any valid account can still exploit it. The attacker can pull private images and their embedded secrets, push or overwrite tags that downstream systems pull, and delete the legitimate instance keys to break pushes and pulls. Affects standalone Quay, the Quay Operator on OpenShift and the mirror registry for OpenShift, including internal registries reachable by untrusted clients. Update Nov 12: The Hacker News reports Red Hat has now released fixed builds for eight Quay 3 branches; check the Red Hat CVE page for your branch, and keep /keys blocked and audit service keys (service_key_rotate events with a null expiration_date) either way."
status: "official (Red Hat solution 7149923 and Bugzilla 2568072, Nov 11, 2026); CVSS 9.8; no fixed build named yet; not reported exploited; UPDATE Nov 12: The Hacker News reports Red Hat has released fixed builds for eight Quay 3 branches (we couldn't yet read the build list on Red Hat's pages), last updated Nov 12, 2026, 11:50 AM ET"
published: 2026-11-12
updated: 2026-11-12T11:50:00-05:00
---

> Red Hat says a flaw in Quay's service key server lets an attacker install an approved, never-expiring signing key and then forge registry tokens for any repository, including other organizations' private repositories. With anonymous access on (the default) no account is needed; turning it off doesn't help because any valid account can still exploit it. The attacker can pull private images and their embedded secrets, push or overwrite tags that downstream systems pull, and delete the legitimate instance keys to break pushes and pulls. Affects standalone Quay, the Quay Operator on OpenShift and the mirror registry for OpenShift, including internal registries reachable by untrusted clients. Update Nov 12: The Hacker News reports Red Hat has now released fixed builds for eight Quay 3 branches; check the Red Hat CVE page for your branch, and keep /keys blocked and audit service keys (service_key_rotate events with a null expiration_date) either way.

[← Cybersecurity News](/news) · [markdown](/items/red-hat-quay-cve-2026-123710-unauthenticated-signing-key-takeover-no-fixed-build.md)

official (Red Hat solution 7149923 and Bugzilla 2568072, Nov 11, 2026); CVSS 9.8; no fixed build named yet; not reported exploited; UPDATE Nov 12: The Hacker News reports Red Hat has released fixed builds for eight Quay 3 branches (we couldn't yet read the build list on Red Hat's pages)

2026-11-12 7:40 AM ET · updated

Nov 12, 2026, 11:50 AM ET

### Red Hat Quay CVE-2026-123710 (9.8): an unauthenticated client can install its own registry signing key and pull or overwrite any private image; no fixed build yet

- **Why it works:** per Bugzilla, `/v2/auth` mints an anonymous token whose audience comes from the client's `service` parameter; the key server accepts it for rotation at `/keys/services/quay/keys/<kid>` without checking what it was issued for, copies the signer's approval to the new key and stores it with no expiry.
- **Do now:** block the `/keys` service-key endpoints at your proxy or load balancer so only trusted internal Quay components reach them; review logs and the service key list for unexpected keys and remove them.
- **Caveats from Red Hat:** deleting a rogue key doesn't stick until a fixed build is deployed, because the anonymous request can install a new one; resetting passwords or robot tokens doesn't revoke a rogue key.
- **Fix status:** SecurityWeek reports fixes for this and CVE-2026-110697 were merged into the Quay GitHub repo on Nov 11, but Red Hat hasn't named a fixed release.
- Found by Red Hat's Dave O'Connor.

Sources: [Red Hat solution 7149923: CVE-2026-123710 Identifying and remediating unauthorized signing keys in Red Hat Quay (updated Nov 11, 2026)](https://access.redhat.com/solutions/7149923) · [Red Hat Bugzilla 2568072 (CVE-2026-123710)](https://bugzilla.redhat.com/show_bug.cgi?id=2568072) · [SecurityWeek: Critical Red Hat Quay Vulnerability Could Expose Private Container Images (Nov 12, 2026)](https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/) · [Red Hat CVE page: CVE-2026-123710](https://access.redhat.com/security/cve/cve-2026-123710) · [The Hacker News: Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry (Nov 12, 2026)](https://thehackernews.com/)