Critical Red Hat Quay flaws expose private images and robot credentials
Red Hat disclosed two critical flaws in Quay on November 11 that can let attackers access private container images and overwrite repositories. The first, CVE-2026-123710, has a CVSS score of 9.8 and can be exploited without an account when anonymous registry access is enabled, Red Hat said.
The flaw lets an attacker add a key to the set Quay trusts for signing access tokens. Quay then accepts tokens signed with that key for any repository. An attacker can use them to retrieve private images, including secrets or credentials stored in those images, and can push or overwrite images that later propagate to systems pulling from the registry, according to Red Hat.
A planted key survives restarts until an operator removes it, and password or robot-token changes do not invalidate it, Red Hat said. The company lists every Quay 3 and Quay 5 version as affected. That includes standalone installations, Quay deployed through the Quay Operator on OpenShift and the mirror registry for Red Hat OpenShift.
Red Hat also disclosed CVE-2026-110697, rated 9.9, which affects users who can create a namespace. A namespace name containing an underscore can cause Quay's database search to match another tenant's namespace and return its robot account tokens. Those tokens can be used to read, push or overwrite the other tenant's images, and Red Hat said the victim does not need to take any action.
Red Hat has released fixed builds for eight Quay 3 branches, and its CVE guidance names the same eight releases as fixed for the robot-account flaw. The company calls updating the only complete fix for CVE-2026-110697. Until an update is installed, Red Hat recommends blocking the /keys endpoint at the proxy or load balancer except for trusted internal components, checking audit logs for service_key_rotate and service_key_delete events with no expiration date, and removing unknown service keys.
For the robot-account flaw, Red Hat suggests restricting who can create organisations or namespaces containing an underscore, rotating robot tokens for matching namespaces and monitoring unusual pulls or pushes. The company says these measures reduce exposure but do not fix the vulnerability. It also says any Quay instance reachable by untrusted clients is exposed, including internal registries.