Red Hat Quay: unauthenticated service-key takeover forges registry tokens (CVE-2026-123710)
Severity: critical · Patch status: partial · Since 2026-11-11 · CVE-2026-110697, CVE-2026-123710
Red Hat rates CVE-2026-123710 Critical (CVSS 3.1 9.8) in the service key server of Red Hat Quay. Key rotation accepts any JWT signed by an already-approved service key that carries the expected audience and issuer, and it never checks that the token is a rotation credential. An anonymous token from /v2/auth passes that check, so a caller who can reach the /keys endpoint can install a signing key of its own, with no expiry and inherited approval. Registry tokens signed with that key are then accepted for every repository, which allows reading and overwriting private images and tags, and the rogue key survives restarts. Red Hat's exposure condition is that /keys is reachable by untrusted clients, and anonymous access is one route to a token rather than the only one. Red Hat lists Quay 3 and Quay 5 as affected. SecurityWeek reports no exploitation in the wild and no public proof-of-concept. The fix is merged to the upstream quay/quay master branch (PR 8056, 2026-11-11), but no tagged release contains it as of 2026-11-12, and Red Hat names no fixed build for this CVE. The same merge fixes CVE-2026-110697, a separate authenticated flaw (CVSS 9.9) that lets a namespace-name wildcard expose other tenants' robot tokens; Red Hat names fixed builds 3.9.28 through 3.18.3 for that one only. Until a fixed build ships, restrict access to /keys, audit servicekeyrotate and servicekeydelete events, and remove any unrecognised approved key.
What to do
- Restrict network access to the /keys service-key endpoint at the proxy or load balancer so only trusted internal components can reach it
- Review audit events service_key_rotate and service_key_delete, especially any with a null expiration_date, and remove every approved service key you do not recognise
- Expect reinstalled keys: deleting a rogue key is not durable until a fixed build is deployed, because the anonymous request can install a new one. Watch for disrupted pushes and pulls
- Treat images and secrets in affected registries as potentially exposed, and rotate credentials embedded in images
- Apply the fixed Quay build as soon as one ships. The fix for CVE-2026-123710 is on master (quay/quay PR #8056) but is not in any tagged release as of 2026-11-12
Sources
All live incidents on Threat Watch
