Red Hat Quay Critical Flaw (CVE-2026-123710, CVSS 9.8) Lets Attackers Read and Overwrite All Private Container Images

Red Hat disclosed CVE-2026-123710, a 9.8-rated flaw in Quay, its container registry software, that lets an attacker who can reach a Quay instance add a service key to the set of keys Quay trusts. Once planted, that key can sign access tokens accepted for any repository, allowing retrieval and overwriting of private container images. Quay enables anonymous access by default, so no account may be needed; with anonymous access disabled, any valid account can still exploit the flaw.

Red Hat also disclosed CVE-2026-110697, rated 9.9, in Quay's robot-account listing code, which builds an SQL LIKE pattern from a namespace name without escaping wildcard characters. A namespace containing an underscore can match another tenant's namespace and return its robot accounts with decrypted tokens, enabling reading, pushing, or overwriting images without elevated privileges. Red Hat says Quay.io is fixed and eight Quay 3 branches have patches, but the CVE record for CVE-2026-123710 still showed packages as affected, and none of the eight advisories listed CVE-2026-110697.

The flaw's logic has existed since Quay's first public commit, and Red Hat lists Quay 3 and Quay 5 as affected. That matters because Quay is not just a file server; it signs tokens that tell clients which images are legitimate. A trusted key with no expiry can survive restarts, password resets, and robot-token changes, letting an attacker poison images that then propagate through CI/CD pipelines into production. Red Hat says internal registries reachable by untrusted clients are exposed.

Organizations using Quay as a private registry or as the integrated registry for OpenShift are directly affected, because stolen or planted credentials can expose secrets inside images and insert malicious images into deployment pipelines. Deleting an attacker's namespace can also delete corresponding robot accounts, cutting off systems that rely on them. Red Hat recommends blocking the /keys endpoint at proxies or load balancers, auditing service_key_rotate and service_key_delete events with null expiration dates, removing unrecognized keys, and installing fixed releases.