Red Hat Quay has two critical flaws that let attackers reach private container images and other tenants’ robot account tokens. One flaw affects any Quay registry an attacker can access, and the other lets a Quay user who can create a namespace steal robot account tokens from other tenants.
Quay registry access and key trust
The first flaw gives an attacker the ability to read and overwrite private images in every repository once they can reach a Quay registry. Anonymous access is enabled by default, so no account is needed while that setting remains on. If anonymous access is turned off, a valid account is enough, and Red Hat said that the company released fixed builds for eight Quay 3 branches yesterday.
The issue is tracked as CVE-2026-123710 with a CVSS score of 9.8. Quay signs access tokens with keys it trusts for image pushes and pulls, and the flaw lets an attacker add a key that Quay will trust without any expiry date. After that, Quay accepts tokens signed with that key for any repository.
Those tokens let the attacker retrieve private images and any secrets or credentials stored inside them. They also let the attacker push or overwrite images, and the modified image then spreads to every system that later pulls it. The planted key stays in place across restarts until someone removes it, and it can also be used to delete the keys that running Quay instances rely on, which causes normal pushes and pulls to fail with authentication errors.
How the key server check fails
Quay’s key server is supposed to verify that a request to replace a key carries a token signed by a trusted key, together with the expected audience and issuer. It does not verify that the token was issued for key rotation. An anonymous token from Quay’s /v2/auth endpoint passes the check because Quay signs it with a trusted key and the caller chooses its audience.
Red Hat’s Dave O’Connor found both flaws. The logic behind CVE-2026-123710 has been present in Quay since its first public commit, according to the bug report for that flaw. Red Hat lists every version of Quay 3 and Quay 5 as affected by both flaws, and its guidance for CVE-2026-123710 includes standalone installs, Quay deployed by the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift.
Shared exposure and listed fixes
Any Quay instance that untrusted clients can reach is exposed, including internal registries, the company says. When checked today, the CVE entry for CVE-2026-123710 still showed every Quay package as affected with no fix, even though each advisory lists the flaw.
The company recommends blocking the /keys endpoint at the proxy or load balancer for everything except trusted internal components. It also recommends searching the audit logs for service_key_rotate and service_key_delete events where expiration_date is null, removing any approved service keys that are not recognized, and installing the fixed release. Until the fixed release is running, an attacker can add a new key the same way, so deleting one does not last.
Red Hat says that turning off anonymous access does not protect against the flaw. A planted key also keeps working after password resets and changes to the robot token.
Namespace matching and robot account theft
The second critical flaw, CVE-2026-110697 with a CVSS score of 9.9, was disclosed at the same time. It lets a Quay user who can create a namespace steal other tenants’ robot account tokens and use them to read, push, or overwrite those tenants’ images. The flaw sits in the code that lists robot accounts, where Quay builds an SQL LIKE pattern from the namespace name without escaping wildcard characters, and an underscore matches any single character in SQL LIKE.
A namespace with an underscore in the right place can match another tenant’s namespace and return its robot accounts, along with their decrypted tokens. The attacker needs no elevated privileges, and the victim does not have to do anything. Deleting the attacker’s namespace also deletes the matching robot accounts, which can cut off systems that depend on them.
OpenShift pipeline exposure and remaining gaps
Where Quay serves as the integrated registry for OpenShift, stolen robot credentials can be used to inject malicious images into CI/CD pipelines, the company says. For CVE-2026-110697, Red Hat’s CVE page names the same eight releases as fixed, calls updating the only complete fix, and says Quay.io is already fixed. None of the eight advisories list CVE-2026-110697.
Until an update is installed, the company suggests limiting who can create organizations or namespaces containing an underscore, rotating robot tokens for any namespace that matches an underscore namespace, and watching for pulls or pushes that do not fit normal robot use. Those steps reduce exposure, but the flaw remains. The upstream fix adds the missing rotation check, requires keys added through the key server to have an expiry date, and stops callers from choosing a token’s audience. The same change fixes the robot account search too.
Licensed under CC BY-ND 4.0 International