CVE-2026-123710 is a critical (CVSS 9.8) flaw in Red Hat Quay that lets an unauthenticated client install its own trusted signing key and then mint registry tokens for any repository.
What Is It
Red Hat disclosed CVE-2026-123710 in Red Hat Quay, its container image registry. NVD published it on November 11, 2026, and lists it as "Awaiting Analysis."
The attack works in four steps:
- An unauthenticated client requests an anonymous registry token and sets the token's audience to a value it controls.
- The client sends that token to Quay's service key rotation endpoint.
- The endpoint accepts the token and installs the client's signing key as an approved key with no expiry.
- Quay accepts any registry token signed with that key, for any repository.
Red Hat classifies the weakness as CWE-1287.
Why It Matters
Red Hat's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- The attack works over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Impact on confidentiality, integrity and availability is high.
According to the description, a successful attacker gets:
- Read access to private images. Content in private repositories could be pulled.
- Write access to repositories. The attacker can push content.
- Tag replacement. Existing repository tags can be pointed at attacker-supplied images. Systems that pull images by tag could then run tampered images.
According to the description, the planted key is installed with no expiry. If so, the attacker's access could persist until the key is found and removed.
Exploitation status: At the time of writing, CISA KEV does not list this CVE, so KEV does not confirm active exploitation.
What's Vulnerable
Red Hat lists these products as affected:
| Product | Package | CPE |
|---|---|---|
| Red Hat Quay 3 | quay/quay-rhel8 |
cpe:/a:redhat:quay:3 |
| Red Hat Quay 3 | quay/quay-rhel9 |
cpe:/a:redhat:quay:3 |
| Red Hat Quay 5 | quay/quay-rhel9 |
cpe:/a:redhat:quay:5 |
The record gives no specific affected or fixed version ranges. The default status for each listed product is "affected."
Patch Status
The NVD record does not name a fixed version or patch. Because the CVE is not in CISA KEV, there is no KEV required action or due date. Quay administrators should:
- Check the Red Hat CVE page and Bugzilla entry below for fixed builds and errata.
- Apply updates when they are available.
- An attacker may have installed a key with no expiry, so review the approved service keys for any you don't recognize.