Red Hat Quay: Unauthorized registry token signing key installation (CVE-2026-123710)

CVE-2026-123710 is a critical vulnerability in Red Hat Quay allowing unauthenticated attackers to hijack the registry's authentication mechanism. By obtaining an anonymous registry token with a user-controlled audience, an attacker can interact with the service key rotation endpoint to install an arbitrary signing key. This key does not expire and is accepted by the registry, allowing the attacker to sign tokens for any repository. This facilitates unauthorized read and write access to private container images and the ability to modify repository tags.

Impact

Successful exploitation grants attackers full unauthorized access to private container registries, including the ability to read private images and manipulate repository tags to distribute malicious content. The CVSS 3.1 base score is 9.8.

Recommendation

Identify all internet-facing or otherwise exposed Red Hat Quay instances. Monitor the Quay audit logs for unusual registry token requests or modifications to signing key configurations. Immediately apply the security updates provided by Red Hat once available to address this vulnerability.