---
schema: 1
kind: vulnerability
title: "CVE-2026-123710 and CVE-2026-110697, Red Hat Quay: an anonymous client can install its own registry signing key and read or overwrite every private image (CVSS 3.1 9.8), and a low-privilege account can steal other tenants' robot tokens (9.9); fixed in Quay 3.9.28 to 3.18.3, no fix for Quay 5 or the mirror registry, no exploitation reported"
headline: "Red Hat Quay: anonymous signing-key takeover and cross-tenant token theft; update to your branch's fixed release"
summary: "Red Hat's CNA records say an unauthenticated client of Red Hat Quay can obtain an anonymous registry token, present it to the service-key rotation endpoint and install its own signing key (CVE-2026-123710, CVSS 3.1 9.8), and that an account that can create a namespace containing an underscore can retrieve other tenants' robot tokens (CVE-2026-110697, 9.9). Red Hat fixed both in Quay 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3, lists Quay 5 and the mirror registry for Red Hat OpenShift 2 as affected with no fix, and NCSC Switzerland lists exploitation as unknown."
discovered_at: "2026-11-14T04:08:00Z"
updated_at: null
event_date: "2026-11-11"
run_id: 2026-11-14T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, supply-chain, pre-auth, auth-bypass, patch-available, no-patch]
regions: [global]
sectors: [technology]
entities: ["product:red-hat-quay", "product:mirror-registry-for-red-hat-openshift"]
techniques: [T1190, T1606, T1525, T1195.002, T1528, T1550.001]
affected_products: ["Red Hat Quay", "Mirror registry for Red Hat OpenShift"]
cves:
  - id: CVE-2026-123710
    cvss: "9.8"
    epss: "0.00657"
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available, no-patch]
    affected: "Red Hat Quay before 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3 on each branch; Red Hat Quay 5 and mirror registry for Red Hat OpenShift 2 affected"
    fixed: "3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7, 3.18.3; none for Quay 5 and mirror registry for Red Hat OpenShift 2; mitigation: restrict /keys to trusted internal components"
  - id: CVE-2026-110697
    cvss: "9.9"
    epss: "0.00741"
    type: logic-flaw
    vector: zero-click
    auth: post-auth
    status: [patch-available, no-patch]
    affected: "Red Hat Quay before 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3 on each branch; Red Hat Quay 5 and mirror registry for Red Hat OpenShift 2 affected"
    fixed: "3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7, 3.18.3; none for Quay 5 and mirror registry for Red Hat OpenShift 2"
sources:
  - url: "https://access.redhat.com/security/cve/cve-2026-123710"
    publisher: "Red Hat (CVE-2026-123710)"
    date: "2026-11-11"
    role: primary
  - url: "https://access.redhat.com/security/cve/cve-2026-110697"
    publisher: "Red Hat (CVE-2026-110697)"
    date: "2026-11-11"
    role: primary
  - url: "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-123710.json"
    publisher: "Red Hat (CSAF VEX, CVE-2026-123710)"
    date: "2026-11-13"
    role: primary
  - url: "https://access.redhat.com/solutions/7149923"
    publisher: "Red Hat (solution article on CVE-2026-123710)"
    date: "2026-11-13"
    role: corroborating
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13178"
    publisher: "NCSC Switzerland (Security Hub advisory 13178)"
    date: "2026-11-13"
    role: corroborating
closed_sources: []
evidence:
  - quote: "An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry."
    publisher: "Red Hat"
    source_url: "https://access.redhat.com/security/cve/cve-2026-123710"
  - quote: "Update to the fixed Red Hat Quay release for your version: 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7, or 3.18.3."
    publisher: "Red Hat"
    source_url: "https://access.redhat.com/security/cve/cve-2026-110697"
verification: single-source
sourcing_note: "Red Hat is the CNA and the only assessor of both flaws; NCSC Switzerland restates its advisory. The CVE-2026-123710 page does not render its fixed-build table, so the builds shown for it are those Red Hat's CVE-2026-110697 page lists, and Red Hat's security data names the same eight builds for both; Red Hat's CSAF record lists Quay 5 and the mirror registry for Red Hat OpenShift 2 as known affected with no fix; no statement covers branches 3.11 and 3.13, which is not evidence that they are unaffected. Whether open user registration is on by default, which CVE-2026-110697 needs in practice, was not verified. A third-party repository created on 2026-11-13 claims a proof of concept for CVE-2026-110697; no vendor or authority refers to it, and it is not linked. Press reports of 2026-11-12 that no fixed version was known are stale."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Update every Red Hat Quay registry to its branch's fixed release (3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 or 3.18.3) and, until then, restrict the /keys endpoint at the proxy or load balancer to trusted internal components; on any instance whose /keys endpoint untrusted clients could reach, review audit logs for service_key_rotate and service_key_delete events with a null expiration_date and remove unrecognised approved service keys, because deleting a rogue key is not durable before the fix and resetting passwords or regenerating robot tokens does not revoke it."
updates: []
migrated_from: null
---

Red Hat's record for CVE-2026-123710 says an unauthenticated client of Red Hat Quay can obtain an anonymous registry token with an audience it chooses, present it to the service-key rotation endpoint and install its own approved signing key with no expiry ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-123710)). NCSC Switzerland summarises the impact as letting network attackers with anonymous or low-privileged access read, overwrite or poison private container images and steal registry credentials, compromising the software supply chain ([NCSC Switzerland, 2026-11-13](https://security-hub.ncsc.admin.ch/#/posts/13178)). The condition is that the /keys endpoint is reachable by untrusted clients ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-123710)); anonymous access is on by default, and turning it off does not protect, because any valid Quay account can still exploit the flaw ([Red Hat, 2026-11-13](https://access.redhat.com/solutions/7149923)).

CVE-2026-110697 lets an attacker who creates a namespace containing an underscore match and retrieve robot accounts and their decrypted tokens from other tenants' namespaces; Red Hat says it needs no elevated privileges or victim interaction and that, where Quay is OpenShift's integrated registry, stolen robot credentials can inject malicious images into CI/CD pipelines ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-110697)).

Red Hat's page for the second flaw lists the fixed builds 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7 and 3.18.3 and says Quay.io is already fixed ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-110697)); its CSAF record for the first flaw links eight Quay errata, RHSA-2026:99019 and 99021 to 99027, as its fixes and lists Red Hat Quay 5 and the mirror registry for Red Hat OpenShift 2 as affected with no fix available ([Red Hat, 2026-11-13](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-123710.json)). NCSC Switzerland lists the exploitation status as unknown ([NCSC Switzerland, 2026-11-13](https://security-hub.ncsc.admin.ch/#/posts/13178)).

**Exposure:** a Red Hat Quay registry, standalone, deployed by the Quay Operator on OpenShift or as the mirror registry for Red Hat OpenShift, whose /keys endpoint untrusted clients can reach, and for the second flaw a multi-tenant registry where an account can create namespaces ([Red Hat, 2026-11-13](https://access.redhat.com/solutions/7149923); [NCSC Switzerland, 2026-11-13](https://security-hub.ncsc.admin.ch/#/posts/13178)).

**Detection:** in Quay audit logs, service_key_rotate and service_key_delete events with a null expiration_date and approved service keys nobody recognises ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-123710)); for token theft, registry pulls or pushes that do not match expected robot-account usage ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-110697)). A planted signing key survives password resets and robot-token regeneration ([Red Hat, 2026-11-13](https://access.redhat.com/solutions/7149923)).

**Defender takeaway:** update to the fixed release of your branch and, until then, restrict /keys at the proxy or load balancer to trusted internal components; a deleted rogue key is not durable before the fix, because the anonymous request can install a new one ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-123710)). Where /keys was reachable, treat registry images as unverified until the keys are reviewed and, for the second flaw, restrict who can create namespaces with an underscore and rotate robot tokens of any namespace that collides with one ([Red Hat, 2026-11-11](https://access.redhat.com/security/cve/cve-2026-110697)).