# Red Hat Quay flaw lets attackers forge access to private repositories

_Published Thursday, November 12, 2026 at 10:19 AM EST · Security · Latest · Tier 2 — Notable_

![Red Hat Quay flaw lets attackers forge access to private repositories — Primary](https://www.securityweek.com/wp-content/uploads/2025/10/Red-Hat.jpeg)

A critical Red Hat Quay vulnerability can let attackers take over the signing of access tokens and read or overwrite any repository in an affected container registry, SecurityWeek reported. CVE-2026-123710 affects deployments whose signing-key management service is reachable by untrusted clients.

Attackers can install a trusted signing key that survives restarts and can have no expiration date. Disabling anonymous access still leaves exploitation possible for valid account holders; password changes do not invalidate an unauthorized key.

Red Hat recommends restricting service access and removing unauthorized keys. Fixes were merged on November 11, but its advisory and Bugzilla report identify no fixed version.

## Sources

- [SecurityWeek](https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/)

---
Canonical: https://techandbusiness.org/newswire/NpUQvDbvu85_FCtDZkftnv
Published: 2026-11-12T15:19:39.782Z
Story chronology: 2026-11-12T09:23:21.000Z
Retrieved: 2026-11-12T16:51:39.831Z
Publisher: Tech & Business (techandbusiness.org)