CVE-2026-1237109.8Critical
CVE-2026-123710: Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation
Red Hat · Red Hat Quay 3
No fix listed · Affected: Red Hat Quay 3 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
9.8CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
Coverage1 article · 1 outlet
First in our coverage: SecurityWeek, 12 Nov.
- Red Hat Quay flaw could expose private container imagesSecurityWeek · first in our coverage
New articles also arrive in the RSS feed.