Critical Red Hat Quay Flaw CVE-2026-123710 Exposes Images

Quay is Red Hat's container registry and also serves as the integrated registry for OpenShift. Red Hat disclosed two critical flaws and released fixed builds for eight Quay 3 branches.

Flaw 1: CVE-2026-123710 (CVSS 9.8)

Quay signs push and pull tokens with trusted keys. The bug lets an attacker add their own key to that trusted set with no expiry, after which Quay accepts the attacker's tokens for any repository. The key server never checks that a token was issued for key rotation, so an anonymous token from /v2/auth is enough.

The impact:

• Pull private images and any secrets inside them.
• Push or overwrite images, with changes reaching every system that pulls them later.
• The planted key survives restarts and can be used to delete Quay's own keys, breaking pushes and pulls.

Anonymous access is on by default, and even with it off any valid account works.

Flaw 2: CVE-2026-110697 (CVSS 9.9)

A user who can create a namespace can steal other tenants' robot account tokens. Namespace names are dropped into an SQL LIKE query with wildcards left unescaped, and an underscore matches any single character.

What to do

1. Install the fixed release now. Deleting a planted key alone does not help, since the attacker can add it again.
2. After updating, review the trusted key list and remove unknown keys.
3. Rotate robot account tokens and any secrets stored in images.
4. The hosted Quay.io service is already fixed.