cve.bz

CVE-2026-123710 Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

9.8 criticalEPSS 0.7%Fix available

Critical (9.8) in redhat quay. EPSS 0.7% estimated probability of exploitation activity in the next 30 days.

On this page
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.7% estimated probability of exploitation activity in the next 30 days; 52nd percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC)
Exploitation: none · Automatable: yes · Technical impact: total, assessed 2026-11-13. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE
CWE-1287 Improper Validation of Specified Type of Input
Published
Modified
Assigned by
redhat (CNA)
NVD analysis
Analyzed
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-123710 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123710?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123710?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123710 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-123710

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-123710](https://cve.bz/cve/badge/CVE-2026-123710.svg)](https://cve.bz/cve/CVE-2026-123710)

HTML:

<a href="https://cve.bz/cve/CVE-2026-123710"><img src="https://cve.bz/cve/badge/CVE-2026-123710.svg" alt="CVE-2026-123710"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
Project Quay quaybefore 3.9.28
Project Quay quayfrom 3.10.0 before 3.10.28
Project Quay quayfrom 3.12.0 before 3.12.24
Project Quay quayfrom 3.14.0 before 3.14.10
Project Quay quayfrom 3.15.0 before 3.15.9
Project Quay quayfrom 3.16.0 before 3.16.7
Project Quay quayfrom 3.17.0 before 3.17.7
Project Quay quayfrom 3.18.0 before 3.18.3

Fixed in

ProductFixed in
Red Hat Quay 3.101793993674
Red Hat Quay 3.121793993854
Red Hat Quay 3.141793993848
Red Hat Quay 3.151793993771
Red Hat Quay 3.161793993799
Red Hat Quay 3.171793993778
Red Hat Quay 3.181793993890
Red Hat Quay 3.91793993730

Fix and patched versions

Red Hat

Red Hat rates this Critical.

Red Hat's statement

This Critical flaw in Red Hat Quay's service key server allows an unauthenticated attacker to take over registry token signing. Key rotation authenticates the caller only by verifying that the JWT is signed by an already approved service key with the expected audience and issuer, without checking that the token is a rotation credential. An anonymous token minted by /v2/auth satisfies that check. Installed keys inherit approval and can be created without an expiry, so forged registry tokens are accepted for any repository. Deployments where /keys is reachable by untrusted clients are affected.

Red Hat's mitigation

Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with a null expiration_date, and remove any unrecognised approved service keys. Deleting a rogue key is not durable until a fixed build is deployed, because the anonymous request can install a new key.

ProductPackageStateAdvisory
Red Hat Quay 3.10quay/quay-rhel8:1793993674Fixed 2026-11-11RHSA-2026:99025
Red Hat Quay 3.12quay/quay-rhel8:1793993854Fixed 2026-11-11RHSA-2026:99027
Red Hat Quay 3.14quay/quay-rhel8:1793993848Fixed 2026-11-11RHSA-2026:99024
Red Hat Quay 3.15quay/quay-rhel8:1793993771Fixed 2026-11-11RHSA-2026:99023
Red Hat Quay 3.16quay/quay-rhel9:1793993799Fixed 2026-11-11RHSA-2026:99022
Red Hat Quay 3.17quay/quay-rhel9:1793993778Fixed 2026-11-11RHSA-2026:99026
Red Hat Quay 3.18quay/quay-rhel9:1793993890Fixed 2026-11-11RHSA-2026:99019
Red Hat Quay 3.9quay/quay-rhel8:1793993730Fixed 2026-11-11RHSA-2026:99021
Red Hat Quay 5quay/quay-rhel9Affected

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-123710.

History

  1. Analyzed by the NVD

Changes since this site first stored the record. The same for every record: /api/public/changes.

References

Check your stackJSON