A critical security vulnerability in Red Hat Quay could allow attackers to access, download, modify or overwrite private container images across every repository in an affected registry.
The vulnerability, identified as CVE-2026-123710, carries a CVSS severity score of 9.8. Red Hat disclosed the flaw on November 12, 2026, and released patched versions across eight Quay 3 branches.
Red Hat Quay is a container registry used by organisations to store and distribute container images. According to the company, an attacker who can reach a vulnerable registry may exploit the weakness without needing an account when anonymous access is enabled. If anonymous access is disabled, an attacker with a valid account can still take advantage of the vulnerability.
The security issue stems from how Quay manages cryptographic keys used to sign access tokens that authorise users and systems to pull or push container images.
The flaw allows an attacker to insert their own key into the registry’s trusted key list without setting an expiration date. Once added, Quay accepts tokens signed with the malicious key across all repositories.
Using those tokens, attackers can retrieve private container images, potentially exposing passwords, credentials and other sensitive information embedded within them. They can also upload malicious images or overwrite existing ones.
Any organisation or system that subsequently downloads an altered image could unknowingly introduce compromised software into its environment.
The malicious key remains active even after Quay is restarted unless an administrator manually removes it. Attackers may also exploit the weakness to delete keys used by running Quay instances, disrupting legitimate image uploads and downloads through authentication failures.
Red Hat explained that the problem lies in the registry’s key server validation process. Although the server checks whether a key replacement request contains a token signed by a trusted key with the expected audience and issuer, it does not verify whether the token was specifically issued for key rotation.
As a result, an anonymous token generated through Quay’s /v2/auth endpoint can satisfy the validation requirements. The registry signs the token using a trusted key, while the requester controls its audience.
A second critical vulnerability, tracked as CVE-2026-110697, was also disclosed, carrying an even higher CVSS score of 9.9.
This weakness could allow a Quay user with permission to create a namespace to steal robot account tokens belonging to other tenants. These credentials could then be used to access, download, upload or overwrite container images belonging to those organisations.
The vulnerability affects the way Quay searches and retrieves robot accounts. Its database query constructs an SQL LIKE pattern using a namespace name without properly escaping wildcard characters.
In SQL LIKE expressions, an underscore represents any single character. Consequently, an attacker can create a namespace containing an underscore in a strategic position to make it match another tenant’s namespace.
This could cause Quay to return the victim’s robot accounts alongside their decrypted authentication tokens.
The attack does not require elevated privileges, and the targeted organisation does not need to interact with the attacker for the credentials to be exposed.
Red Hat also warned that deleting the attacker’s namespace could remove the associated robot accounts, potentially disrupting systems that depend on those credentials.
For organisations using Quay as their integrated container registry within OpenShift, stolen robot account credentials could be abused to introduce malicious container images into continuous integration and continuous delivery (CI/CD) pipelines.
Both vulnerabilities were discovered by Red Hat’s Dave O’Connor.
According to the company, the vulnerable logic behind CVE-2026-123710 has existed in Quay since its first public commit.
Red Hat identified Quay 3 and Quay 5 releases as affected by the two vulnerabilities. For CVE-2026-123710, the company’s advisory specifically includes standalone Quay deployments, installations managed through the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift.
The company warned that any Quay registry accessible to untrusted clients could be exposed, including registries operating within internal networks.
Red Hat has published fixed releases for the affected branches. However, there are differences in how the two vulnerabilities are reflected across its security advisories.
For CVE-2026-123710, the vulnerability entry still showed affected Quay packages without a fix at the time of the report, despite the availability of remediation information in the individual advisories.
For CVE-2026-110697, Red Hat’s security page identifies the same eight releases as fixed and states that updating is the only complete solution. The company also confirmed that Quay.io has already been patched. However, the eight advisories did not individually list the second vulnerability.
Recommended mitigation measures
Red Hat advised administrators to take immediate steps to reduce the risk while preparing and deploying the patched releases.
First, organisations should configure their reverse proxies or load balancers to restrict access to the /keys endpoint, allowing requests only from trusted internal components.
Administrators should also examine audit logs for service_key_rotate and service_key_delete events involving entries where the expiration_date field is set to null. Any unfamiliar or unauthorised service keys should be removed.
However, removing suspicious keys without installing the security update may not provide lasting protection because attackers could exploit the same vulnerability to introduce replacement keys.
Red Hat emphasised that disabling anonymous access does not eliminate the risk. Furthermore, malicious keys already planted in a registry can remain valid even after administrators reset passwords or change robot account tokens.
For CVE-2026-110697, organisations that have not yet updated should restrict permissions for creating organisations or namespaces containing underscores.
They should also rotate robot account tokens associated with namespaces that could match underscore-containing namespaces and monitor image uploads and downloads for activities that deviate from normal usage patterns.
Red Hat stressed that these temporary precautions can reduce exposure but do not eliminate the underlying vulnerability.
The upstream security update addresses both weaknesses by introducing an additional verification requirement for key rotation, requiring newly added keys to have an expiration date and preventing requesters from choosing the audience of authentication tokens.
The same update also corrects the vulnerable robot account search functionality.
Red Hat’s central recommendation is for organisations running affected Quay deployments to install the appropriate fixed release as soon as possible, particularly where registries are accessible to untrusted users or connected to software development and deployment pipelines.