CVE-2026-123710— Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

Quick assessment

Affected

Red Hat Red Hat Quay 3

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Red Hat Quay 中发现了一个漏洞。未认证的客户端可以获取一个由其控制受众（audience）的匿名注册表令牌，并将该令牌提交至服务密钥轮换端点，从而安装一个无过期时间的自有已批准签名密钥。使用该密钥签名的注册表令牌会被接受用于任意仓库，导致攻击者能够读取和写入私有镜像，并替换仓库标签。

CVSS 9.8 · Critical Updated Nov 11, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1287

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Quay 3	-	`cpe:/a:redhat:quay:3`
Red Hat	Red Hat Quay 3	-	`cpe:/a:redhat:quay:3`
Red Hat	Red Hat Quay 5	-	`cpe:/a:redhat:quay:5`

II. Public POCs for CVE-2026-123710

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123710

请登录查看更多情报信息。

Other References for CVE-2026-123710 (2)

https://access.redhat.com/security/cve/CVE-2026-123710 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2568072 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-123710

Same Patch Batch · Red Hat · 2026-11-11 · 12 CVEs total

CVE-2026-124741	7.6 HIGH	Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
CVE-2026-124739	7.5 HIGH	Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
CVE-2026-124737	7.5 HIGH	Busybox: heap buffer overflow in the tftp client on fallback to the default block size
CVE-2026-116468	6.6 MEDIUM	Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group m
CVE-2026-124744	6.3 MEDIUM	Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
CVE-2026-124745	6.3 MEDIUM	Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extr
CVE-2026-124746	5.5 MEDIUM	Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound
CVE-2026-124743	5.5 MEDIUM	Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
CVE-2026-124742	5.5 MEDIUM	Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value
CVE-2026-124738	5.3 MEDIUM	Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
CVE-2026-124740	4.3 MEDIUM	Busybox: use-after-free of requested_ipv6 in udhcpc6

IV. Related Vulnerabilities

Same product: Red Hat Quay 3

Same vendor: Red Hat

Same weakness: CWE-1287