Red Hat Quay: Unauthenticated registry signing-key takeover via service key rotation

Summary

A flaw in the service key rotation endpoint of Red Hat Quay allows an unauthenticated attacker to install their own approved signing key without expiry. Registry tokens signed with this key are accepted for any repository, which allows reading and writing private images and replacing repository tags. Exposure depends on whether the /keys endpoint is reachable by untrusted clients.

Affected

• Red Hat Quay 3 (quay-rhel8 and quay-rhel9 images), according to the CVE record and third-party data
• Red Hat Quay 5 (quay-rhel9 image), according to the CVE record and third-party data
• Exact affected version ranges: Unknown.
• Deployments where the /keys endpoint is reachable by untrusted clients are affected.

Fixed in

Unknown. No fixed version or erratum was found at the time of writing.

Workaround

• Restrict access to the /keys endpoint at the reverse proxy or load balancer so only trusted internal components can reach it.
• Review audit logs for service_key_rotate and service_key_delete events with a null expiration_date and remove unrecognised approved service keys.
• Deleting a rogue key is not durable until a fixed build is deployed, because the anonymous request can install a new key.

Exploitation

• Public proof-of-concept exploit: none found.
• Listed as not known to be exploited by third-party tracker OffSeq.
• CISA KEV listing: not checked.

Our recommendation

• Check whether any Quay 3 or Quay 5 instance is deployed and which version it runs.
• Block untrusted access to the /keys endpoint now at the proxy or load balancer.
• Audit service key rotation and deletion events for unknown or non-expiring keys.
• Monitor Red Hat's CVE page and Quay errata and patch as soon as a fix is released.
• After patching, review whether unknown signing keys were added before the fix and rotate registry-related credentials if necessary.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Red Hat CVE page CVE-2026-123710 access.redhat.com
• Red Hat Bugzilla 2568072 bugzilla.redhat.com
• OffSeq threat record CVE-2026-123710 radar.offseq.com
• Red Hat Quay 3 documentation docs.redhat.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:20.