Red Hat Quay Flaw Exposes Private Container Images to Attackers
A critical vulnerability in Red Hat’s enterprise container registry, Quay, has been discovered, allowing attackers to access and manipulate private container images. The flaw affects deployments where the service responsible for managing signing keys is accessible to untrusted clients, putting organizations that rely on Quay at risk.
The vulnerability, tracked as CVE-2026-123710, has a CVSS score of 9.8, making it one of the most critical flaws in recent memory. When anonymous access is enabled, an attacker without an account can obtain a registry token and exploit weaknesses in the key rotation mechanism to install their own trusted signing key. This allows them to generate tokens granting read and write access to any repository, bypassing normal access restrictions.
In essence, this means that attackers can gain unauthorized access to private images, exposing sensitive data such as credentials or other secrets stored within them. Moreover, they can overwrite images that other systems subsequently download, disrupting the integrity of containerized applications. The malicious signing key can even be configured without an expiration date and survives registry restarts unless removed, further complicating mitigation efforts.
Red Hat warns that simply turning off anonymous access is not enough to protect against this flaw, as any valid Quay account can still exploit it. Changing passwords or regenerating robot tokens also does not invalidate an unauthorized signing key. The company recommends restricting access to the key-management service, reviewing logs for suspicious key changes, and removing unauthorized keys.
The discovery of this vulnerability highlights the importance of secure configuration and management practices in containerized environments. While Red Hat has released guidance on mitigating this flaw, it is essential that organizations take immediate action to protect themselves against potential attacks. As we have seen with other recent vulnerabilities, attackers can exploit these weaknesses quickly, so timely patching and security measures are crucial.
In practical terms, users of Red Hat Quay should review their configuration settings and ensure that access to the key-management service is strictly controlled. Regularly monitoring logs for suspicious activity and promptly removing unauthorized keys will also help prevent exploitation.
Source: SecurityWeek — 2026-11-12