# Critical Vulnerability in Red Hat Quay Exposes Container Registries to Severe Risks

*Published November 13, 2026*
*Source: [https://cybersecuritynews.com/red-hat-quay-vulnerability/](https://cybersecuritynews.com/red-hat-quay-vulnerability/)*

## Executive Summary

A critical vulnerability in Red Hat Quay allows unauthorized users to take control of registry token signing, threatening the security of container images. The flaw, which affects Quay versions 3 and 5, demands immediate action to restrict key server access and monitor for suspicious activity.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/critical-vulnerability-in-red-hat-quay-exposes-container-registries-to-severe-risks) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A serious vulnerability identified in Red Hat Quay could allow unauthorized users to gain control over registry token signing. This flaw, cataloged as CVE-2026-123710, has been given a high CVSS score of 9.8 by Red Hat and the National Vulnerability Database. The vulnerability was publicly disclosed on November 11, 2026.

Red Hat Quay functions as an enterprise container registry, pivotal for storing and serving container images. The vulnerability lies within its service key server. When a key rotation request is made, the server improperly verifies tokens, checking only that the JWT is signed by an authorized key with the correct audience and issuer, but failing to confirm if the token genuinely requests a key rotation.

This loophole allows attackers to exploit anonymous tokens from the /v2/auth endpoint, which can pass the server's checks. Attackers can then send their own keys to the /keys endpoint, where they receive approval and can be stored indefinitely. These keys are instantly trusted by Quay, enabling the attacker to sign registry tokens for any repository. This level of access allows unauthorized reading and overwriting of private images, potentially exposing sensitive information far beyond the registry.

The issue affects Quay versions 3 and 5, particularly when the /keys endpoint is accessible by untrusted clients. The vulnerability has existed since Quay's initial public release. Red Hat advises restricting access to /keys to only trusted internal components via a proxy or load balancer, reviewing audit logs for suspicious key rotation events, and removing unfamiliar service keys.

Although no active exploits have been reported, this vulnerability's straightforward exploitation path and potential for significant damage make it a pressing concern. Organizations must remain vigilant, maintain the /keys access block, and monitor Red Hat's advisory for updates on a patched version.