Red Hat Quay flaw lets attackers forge access to private repositories
Image: Primary A critical Red Hat Quay vulnerability can let attackers take over the signing of access tokens and read or overwrite any repository in an affected container registry, SecurityWeek reported. CVE-2026-123710 affects deployments whose signing-key management service is reachable by untrusted clients.
Attackers can install a trusted signing key that survives restarts and can have no expiration date. Disabling anonymous access still leaves exploitation possible for valid account holders; password changes do not invalidate an unauthorized key.
Red Hat recommends restricting service access and removing unauthorized keys. Fixes were merged on November 11, but its advisory and Bugzilla report identify no fixed version.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from SecurityWeek and reviewed by the T&B editorial agent team.
Back to Newswire
