Overview
Red Hat has patched two critical vulnerabilities in Quay, its container image registry platform, that could allow attackers to access private container images, steal credentials and potentially overwrite images used by production workloads. The most severe flaw, CVE-2026-123710, carries a CVSS score of 9.8 and can be exploited even when anonymous access is disabled if the attacker can reach the registry.
What Was Discovered
CVE-2026-123710 allows an attacker to add a malicious signing key to Quay’s trusted keys without an expiry date. The attacker can then create valid access tokens for repositories and use them to pull, push or overwrite private container images. The malicious key survives service restarts and can potentially remain active until manually removed, making this more serious than a simple credential compromise.
Supply Chain Risk
A second flaw, CVE-2026-110697, rated 9.9, allows a Quay user to potentially obtain another tenant’s robot-account credentials through flawed namespace handling. Those credentials could provide access to private images and allow malicious images to be pushed into repositories. In environments where Quay is integrated with OpenShift or CI/CD pipelines, this creates a potential software supply-chain attack path.
Why It Matters
Container registries are effectively the software supply chain for modern applications. If an attacker can read private images, they may discover embedded secrets, credentials or proprietary code; if they can overwrite images, they may be able to introduce malicious code that is later deployed by automated pipelines. The risk therefore extends beyond the registry itself to Kubernetes, OpenShift, CI/CD systems and production workloads.
What IT Teams Should Do
Administrators should patch affected Quay deployments immediately and review audit logs for unexpected service_key_rotate or service_key_delete activity, particularly where keys have no expiry date. Remove unfamiliar trusted keys and investigate unexpected image pulls, pushes and robot-account activity. Until patched, Red Hat recommends restricting access to the /keys endpoint and limiting who can create namespaces containing underscores, although these measures are only temporary mitigations.
Expert in the Cloud Insight
Your container registry should be treated as a Tier-1 security system, not simply as a repository for Docker images. A compromised registry can become the bridge between an external attacker and the applications running across your cloud environment. Strong registry access controls, short-lived credentials, image signing, vulnerability scanning, immutable production images and continuous monitoring should form part of the organisation’s broader cloud and software supply-chain security strategy.
Expert in the Cloud – The Future Is Now.
Leave a Reply