RED HAT QUAY · CVE-2026-123710 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Red Hat Quay, a container image registry, lets an unauthenticated client obtain an anonymous registry token with an audience it controls and use it on the service key rotation endpoint to install its own signing key with no expiry. Tokens signed with that key are then accepted for any repository, giving read and write access to private images and the ability to replace repository tags.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted Red Hat Quay (NVD lists Quay 3 and Quay 5 as affected) are exposed where the /keys endpoint is reachable by untrusted clients. Anyone who can get an anonymous token from /v2/auth can install a signing key and read or write any private repository. Teams on a registry they do not operate, or with /keys limited to internal components, can skip it.
Not affected if managed-hosting
Who cares container-registry, red-hat-quay, self-hosted, unauthenticated
Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.