Critical Red Hat Quay Vulnerability Allows Theft of Private Container Images
A critical vulnerability (CVE-2026-123710) in Red Hat Quay allows unauthenticated attackers to steal private container images and gain persistent access by installing malicious signing keys.
A critical vulnerability in Red Hat Quay, a widely used enterprise container registry and Kubernetes security platform, could allow attackers to steal private container images, overwrite existing repositories, and establish persistent access.
The flaw, tracked as CVE-2026-123710 and carrying a CVSS score of 9.8, impacts deployments where the service responsible for managing signing keys is exposed to untrusted clients. Red Hat's advisory states that this critical flaw in Quay's service key server enables an unauthenticated attacker to take over registry token signing.
When anonymous access is enabled, an attacker can exploit weaknesses in the key rotation mechanism to install their own trusted signing key. This allows them to generate tokens that grant both read and write access to any repository, effectively bypassing normal access controls. The consequences include the exposure of sensitive intellectual property stored within private container images, as well as the potential for attackers to replace legitimate images with malicious versions.
Once installed, the attacker-controlled signing key can be configured without an expiration date and will persist across registry restarts unless manually removed. Red Hat's Bugzilla report further details that the key rotation process can also delete legitimate instance keys as a side effect, and the attacker's key can interfere with the installation of replacement keys, potentially disrupting normal registry operations.
Red Hat emphasizes that disabling anonymous access does not fully mitigate the risk, as any valid Quay account can still exploit the vulnerability. Furthermore, changing passwords or regenerating robot tokens will not invalidate an unauthorized signing key that has already been installed. This means that even authenticated users could inadvertently use compromised images or have their access abused.
To address the threat, Red Hat recommends restricting access to the key-management service, diligently reviewing logs for any suspicious key changes, and actively removing any unauthorized keys. However, the company cautions that until a permanent fix is deployed, attackers could potentially reinstall malicious keys, necessitating ongoing vigilance.
While Red Hat has not yet released a fixed version, patches for CVE-2026-123710 and another related Quay vulnerability (CVE-2026-110697) were merged into the project's GitHub repository on November 11, indicating that a resolution is imminent. The discovery of this vulnerability is credited to Red Hat's Dave O’Connor.
This vulnerability highlights the critical importance of securing the internal components of container registries, as a compromise in key management can have far-reaching implications for the integrity and confidentiality of containerized applications and their associated data.