Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries
Critical Red Hat Quay vulnerability (CVE-2026-123710, CVSS 9.8) allows unauthenticated token hijacking.
A critical vulnerability in Red Hat Quay container registries (CVE-2026-123710, CVSS 9.8) allows unauthenticated attackers to hijack token signing by manipulating the /keys endpoint when FEATURE_ANONYMOUS_ACCESS is enabled. The flaw permits attackers to inject malicious signing keys, gain read/write access to private container images, and swap repository tags, potentially compromising the entire software supply chain. Red Hat recommends immediately restricting /keys access at the proxy/load balancer level and auditing for rogue service keys until a patched version is released.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Red Hat?
Get an email when a new story names Red Hat, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical flaw in Red Hat Quay (CVE-2026-123710, CVSS 9.8) demonstrates how a permissive default feature flag—FEATURE_ANONYMOUS_ACCESS—combined with an unprotected cryptographic endpoint can hand attackers the keys to an entire container registry. By injecting malicious signing keys via the /keys endpoint, unauthenticated adversaries can gain read/write control over private images and manipulate repository tags, poisoning any downstream software built from those images. This matters far beyond the registry itself: compromised container images propagate silently into CI/CD pipelines, production deployments, and customer environments. The incident underscores that cryptographic trust mechanisms are only as strong as the access controls protecting them.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-123710