# SZB-03e2ca31f9: Red Hat reports critical Quay flaw CVE-2026-123710 enabling signing-key takeover

Red Hat says CVE-2026-123710, rated CVSS 9.8, lets an unauthenticated attacker take over registry token signing in Red Hat Quay on deployments where the key service is reachable by untrusted clients.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Red Hat
- Product: Quay
- Status: Confirmed
- Sources: 3 distinct
- First seen: 2026-11-11 16:04 UTC
- Confirmed: 2026-11-12 09:30 UTC

Written by a model from the sources below. Verify against them.

## Summary

Red Hat says CVE-2026-123710, rated CVSS 9.8, lets an unauthenticated attacker take over registry token signing in Red Hat Quay on deployments where the key service is reachable by untrusted clients. Red Hat's advisory says no fixed version was identified, and fixes merged into the project's GitHub repository on November 11 are referenced in the item.

## What to do

- Restrict network access to the Quay service key-management service to trusted clients only.
- Review logs for suspicious signing-key changes and remove any unauthorized keys.
- Monitor for reinstalled malicious keys until a fixed version is deployed.
- Apply the fixes for CVE-2026-123710 and CVE-2026-110697 as soon as a fixed release is available.
- Install the fixed Quay release as soon as possible.
- At the proxy or load balancer, block the /keys endpoint for everything except trusted internal components.

## Timeline

- 2026-11-11 16:03 UTC: Made public by Mastodon
- 2026-11-11 16:04 UTC: First seen by cve.now
- 2026-11-12 09:30 UTC: Confirmed as CVE-2026-123710
- 2026-11-12 16:36 UTC: Record last updated

## Evidence (3 sources)

- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117598649888379135): “A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry.”
- 2026-11-12 · Press · [SecurityWeek](https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/): “A critical vulnerability in Red Hat Quay could allow attackers to access private container images and replace content in repositories across an affected registry.”
- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html): “A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-03e2ca31f9&body=https%3A%2F%2Fcve.now%2FSZB-03e2ca31f9%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-03e2ca31f9

### Has Red Hat confirmed it?

Yes. Confirmed as CVE-2026-123710.

Source: https://mastodon.social/@EUVD_Bot/117598649888379135, https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/, https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html

### What should Red Hat and Red Hat Quay users do?

Restrict network access to the Quay service key-management service to trusted clients only. Review logs for suspicious signing-key changes and remove any unauthorized keys. Monitor for reinstalled malicious keys until a fixed version is deployed. Apply the fixes for CVE-2026-123710 and CVE-2026-110697 as soon as a fixed release is available. Install the fixed Quay release as soon as possible. At the proxy or load balancer, block the /keys endpoint for everything except trusted internal components.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-123710 and CVE-2026-110697.

Source: https://cve.now/CVE-2026-123710, https://cve.now/CVE-2026-110697

## Tracked as

- [CVE-2026-123710](https://cve.now/CVE-2026-123710.md)
- [CVE-2026-110697](https://cve.now/CVE-2026-110697.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-03e2ca31f9
Site guide for agents: https://cve.now/llms.txt