Cpe:2.3:a:red_hat:quay:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ared_hatquay/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:06:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRed Hat Quay: Unauthorized registry token signing key installation (CVE-2026-123710)https://feed.craftedsignal.io/briefs/2026-11-red-hat-quay-auth-bypass-cve-2026-123710/Wed, 11 Nov 2026 16:06:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-red-hat-quay-auth-bypass-cve-2026-123710/A critical vulnerability in Red Hat Quay allows an unauthenticated attacker to manipulate the service key rotation endpoint, enabling the installation of a malicious signing key to forge registry tokens and gain unauthorized access to private images.CVE-2026-123710 is a critical vulnerability in Red Hat Quay allowing unauthenticated attackers to hijack the registry's authentication mechanism. By obtaining an anonymous registry token with a user-controlled audience, an attacker can interact with the service key rotation endpoint to install an arbitrary signing key. This key does not expire and is accepted by the registry, allowing the attacker to sign tokens for any repository. This facilitates unauthorized read and write access to private container images and the ability to modify repository tags.

Impact

Successful exploitation grants attackers full unauthorized access to private container registries, including the ability to read private images and manipulate repository tags to distribute malicious content. The CVSS 3.1 base score is 9.8.

Recommendation

Identify all internet-facing or otherwise exposed Red Hat Quay instances. Monitor the Quay audit logs for unusual registry token requests or modifications to signing key configurations. Immediately apply the security updates provided by Red Hat once available to address this vulnerability.

]]>criticaladvisory