Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-123710 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | Red Hat |
| Product | Quay |
| Vulnerability Type | improper validation of input type, authentication bypass (CWE-1287) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
Replacing a tag (e.g. latest or a production version) means the cluster will run an attacker-prepared image on its next deployment — a classic supply chain attack. A second critical Quay flaw was published at the same time — CVE-2026-110697.
Required Actions
- Update Red Hat Quay to the fixed version listed on the Red Hat page for CVE-2026-123710.
- Review the service keys in Quay and remove any you do not recognize — especially those with no expiry.
- Verify the integrity of images in private repositories (digests, signatures) and review tag history.
- Until updated, restrict network access to Quay to trusted networks.
Who Is Affected?
The vulnerability affects Red Hat Quay — a private container image registry often deployed alongside OpenShift. Internet-facing instances are particularly exposed.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-123710 vulnerability?
CVE-2026-123710 is a flaw in Red Hat Quay (CWE-1287) that lets an unauthenticated client install its own signing key and gain read and write access to any repository. CVSS score: 9.8.
Does exploiting CVE-2026-123710 require authentication?
No. The attack is carried out remotely and requires no authentication or user interaction.
How to protect against CVE-2026-123710?
Update Red Hat Quay to the fixed version, remove unknown service keys and verify image integrity.
Who is affected by CVE-2026-123710?
Organizations using Red Hat Quay as a container image registry.
