L3 · ShartedRed Hat · Quay · containers · registryquay-registry-access

Red Hat Quay flaws expose registry signing and cross-tenant robot tokens

One Quay flaw lets an unauthenticated client with access to /keys install a registry signing key. Another lets a user who can create a namespace steal robot tokens from matching tenants. Either path can expose or alter private images.

Disclosed: Nov 11, 2026; Public disclosure date
Severity: CVSS 9.9 × 1; 2 CVEs tracked here
Splash zone: Quay registries exposing /keys to untrusted clients and shared registries that let users create namespaces; Red Hat · Quay · containers · registry
In the wild: Unknown; Red Hat’s disclosures do not report successful exploitation.

What happened

Red Hat disclosed two separate authorization failures in Quay. CVE-2026-123710 lets a client reach the key rotation service with an anonymous registry token accepted as a rotation credential. The client can install a signing key without expiry, then mint tokens with access to private repositories or replace tags. The exposed route is /keys. Red Hat lists affected packages in Quay 3 and Quay 5. The November 11 errata linked below explicitly list the signing-key fix in 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3. Consult the errata or Red Hat support for other streams.

CVE-2026-110697 requires an authenticated user who can create a namespace with an underscore. The underscore acts as a wildcard in robot-account lookup, returning credentials for another matching namespace. Red Hat confirms a Quay.io fix for this robot-token issue. For self-managed installations, verify both CVEs separately when selecting a build. Limit access during the rollout and review image digests and credentials before trusting affected artifacts.

What’s in the bowl

CVE-2026-123710CVSS 9.8

Registry token-signing key takeover

An unauthenticated client that can reach /keys can use an anonymous token to register an approved signing key and forge tokens for any repository.

CVE-2026-110697CVSS 9.9

Cross-tenant robot token exposure

An authenticated user able to create a namespace can use an underscore as a wildcard to retrieve robot account tokens from matching namespaces.

Crime-scene timeline

Nov 11, 2026
Red Hat discloses two Quay vulnerabilities
The two advisories describe abuse of signing-key rotation and theft of robot tokens across tenants.
Nov 11, 2026
Red Hat publishes updated Quay images
The errata identify fixes for particular release streams. Red Hat also says Quay.io has been fixed for the robot-token issue.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Red Hat signing-key advisoryPrimaryDescribes the anonymous token path, affected packages, route restriction and audit events.
Red Hat robot-token advisoryPrimaryDescribes prerequisites, fixed versions, Quay.io status and interim mitigations.
Red Hat RHSA-2026:99021PrimaryLists CVE-2026-123710 in the 3.9.28 image erratum.
Red Hat RHSA-2026:99022PrimaryLists CVE-2026-123710 in the 3.16.7 image erratum.
Red Hat RHSA-2026:99023PrimaryLists CVE-2026-123710 in the 3.15.9 image erratum.
Red Hat RHSA-2026:99024PrimaryLists CVE-2026-123710 in the 3.14.10 image erratum.
Red Hat RHSA-2026:99025PrimaryLists CVE-2026-123710 in the 3.10.28 image erratum.
Red Hat RHSA-2026:99026PrimaryLists CVE-2026-123710 in the 3.17.7 image erratum.
Red Hat RHSA-2026:99027PrimaryLists CVE-2026-123710 in the 3.12.24 image erratum.
Red Hat RHSA-2026:99019PrimaryLists CVE-2026-123710 in the 3.18.3 image erratum.

Wipe guide

The wipe checklist

0 of 4 sheets used

Restrict access to the key serviceAt the reverse proxy or load balancer, allow only trusted internal components to reach /keys. Verify from an untrusted network that the route is blocked and from internal services that required access still works.
Upgrade and verify coverage for both CVEsMatch the release and image digest to the erratum for CVE-2026-123710. Red Hat’s separate CVE-2026-110697 bulletin lists the same Quay 3 fixes starting at 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3. Ask Red Hat to confirm coverage for other streams.
Audit service signing keys and image changesPreserve audit logs and inventory approved keys. Check service_key_rotate and service_key_delete events for a null expiration_date and correlate with expected key management. Remove unrecognized approved keys after closing the route. Investigate unusual pulls, pushes, digest changes and replaced tags. Redeploy affected workloads from verified digests if image integrity was compromised.
Limit namespace creation and rotate exposed robot tokensWhile patching, restrict who can create names containing underscores. Identify matching namespaces, revoke and replace potentially exposed robot tokens in Quay and update their CI and cluster secrets. Monitor pulls and pushes against expected robot usage.