Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry Swati KhandelwalNov 12, 2026Vulnerability / Cloud Security A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is off, anyone with a valid account can still exploit the flaw, Red Hat said yesterday. The company has released fixed builds for eight Quay 3 branches. The flaw is tracked as CVE-2026-123710 (CVSS score: 9.8). Quay uses keys it trusts to sign the access tokens that allow image pushes and pulls. The flaw lets an attacker add their own key to the keys Quay trusts, with no expiry date. Quay then accepts tokens signed with that key for any repository. With those tokens, an attacker can retrieve private images and any secrets or credentials stored within them. The attacker can also push or overwrite images, and the change propagates to every system that later pulls those images. The planted key survives restarts until someone removes it. It can also be used to delete the keys that running Quay instances use, so normal pushes and pulls start failing with authentication errors. Quay's key server checks that a request to replace a key carries a token signed by a trusted key, with the expected audience and issuer. It does not check whether the token was issued for key rotation. An anonymous token from Quay's /v2/auth endpoint passes: Quay signs it with a trusted key, and the caller chooses its audience. A second critical flaw, CVE-2026-110697 (CVSS score: 9.9), was disclosed at the same time. It lets a Quay user who can create a namespace steal other tenants' robot account tokens and use them to read, push, or overwrite those tenants' images. This flaw is in the code that lists robot accounts. It builds an SQL LIKE pattern from the namespace name without escaping wildcard characters, and in SQL LIKE an underscore matches any single character. So a namespace with an underscore in the right place can match another tenant's namespace and return its robot accounts, with their decrypted tokens. The attacker needs no elevated privileges, and the victim does not have to do anything. Deleting the attacker's namespace also deletes the corresponding robot accounts, which can cut off systems that rely on them. Where Quay is the integrated registry for OpenShift, stolen robot credentials can be used to inject malicious images into CI/CD pipelines, the company says. Red Hat's Dave O'Connor found both flaws. The logic behind CVE-2026-123710 has been in Quay since its first public commit, according to the bug report for that flaw. Red Hat lists every version of Quay 3 and Quay 5 as affected by both flaws. For CVE-2026-123710, its guidance names standalone installs, Quay deployed by the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift as affected. Any Quay instance that untrusted clients can reach is exposed, including internal registries, the company says. When checked today, the CVE entry for CVE-2026-123710 still showed every Quay package as affected, with no fix, even though each advisory lists the flaw. At the proxy or load balancer, block the /keys endpoint for everything except trusted internal components. Search the audit logs for service_key_rotate and service_key_delete events where expiration_date is null. Remove any approved service keys you do not recognize. Install the fixed release. Until it is running, an attacker can add a new key the same way, so deleting one does not last. "Turning off anonymous access doesn't protect you," the company says in its key remediation article. A planted key also continues to work after password resets and changes to the robot token. For CVE-2026-110697, the company's CVE page names the same eight releases as fixed, calls updating the only complete fix, and says Quay.io is already fixed. But none of the eight advisories list CVE-2026-110697. Until an update is in place, the company suggests limiting who can create organizations or namespaces containing an underscore, rotating robot tokens for any namespace that matches an underscore namespace, and watching for pulls or pushes that do not fit normal robot use. These steps reduce the exposure, but the flaw remains. The upstream fix adds the missing rotation check, requires keys added through the key server to have an expiry date, and stops callers from choosing a token's audience. The same change fixes the robot account search too. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Authentication, Cloud security, Container Security, Supply Chain, Vulnerability Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run The Flood is Coming And The Pipes Were Already Full Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk