Critical Red Hat Quay Vulnerability (CVE-2026-123710) Allows Unauthenticated Registry Signing-Key Takeover and Exposure of Private Container Images

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5849 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Red Hat Quay Service Key Server /keys Write Requests from Non-Internal Sources (CVE-2026-123710)

Detects PUT/POST/DELETE requests to the Red Hat Quay service key server (/keys/services/quay/keys/...) originating from non-RFC1918 addresses. CVE-2026-123710 lets an anonymous or low-privilege bearer JWT rotate service keys through this endpoint, installing an attacker-controlled never-expiring signing key (TL-2026-5849, T1190, T1606). Legitimate key rotation is performed only by trusted internal Quay components, so any external write is high-fidelity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1606
• Data sources: nginx/proxy access logs (index=web sourcetype=access_combined), CommonSecurityLog (WAF/proxy CEF), web server access logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h uri_path="/keys/services/*" method IN ("PUT","POST","DELETE") | where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip)) | stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(status) as statuses values(uri_path) as paths by clientip host | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

CommonSecurityLog | where TimeGenerated > ago(24h) | where RequestURL has "/keys/services/" | where RequestMethod in~ ("PUT", "POST", "DELETE") | where not(ipv4_is_private(SourceIP)) | project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, Activity | order by TimeGenerated desc

Sigma

title: Red Hat Quay Service Key Write Request from Non-Internal Source (CVE-2026-123710)
id: 7c1e4f52-3a9b-4d68-9e21-5b0a8c6d1f01
status: experimental
description: Detects PUT/POST/DELETE requests to the Quay service key server /keys/services/ path from non-RFC1918 clients, the key rotation call abused by CVE-2026-123710 to install a rogue signing key.
references:
    - https://access.redhat.com/security/cve/cve-2026-123710
    - https://bugzilla.redhat.com/show_bug.cgi?id=2568072
    - https://github.com/quay/quay/pull/8056
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - cve.2026.123710
logsource:
    category: webserver
detection:
    selection:
        cs-method:
            - 'PUT'
            - 'POST'
            - 'DELETE'
        cs-uri-stem|contains: '/keys/services/'
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Quay components or a load balancer health proxy reaching the key server through a public or NAT address
level: high

Known false positives:

• Quay Operator or sibling Quay pods calling /keys via a NAT or public address
• Authorized penetration test or vulnerability scan against the registry

Tuning notes: Replace the RFC1918 ranges with your actual Quay component, ingress and load-balancer CIDRs. Adjust index/sourcetype to where the Quay ingress/nginx logs land. If the proxy rewrites client IPs, use the X-Forwarded-For field instead of clientip.

• 🔒 Quay [indicator] Non-FQDN Audience Request Followed by [indicator] Write from Same Source · unlock with TL Creds
• 🔒 Quay Image Push or Tag Move by Previously Unseen Identity/Source (Image Overwrite) · unlock with TL Creds
• 🔒 Quay Signing Key Rotate and Delete Within 10 Minutes (Legitimate Instance Key Removed) · unlock with TL Creds
• 🔒 Command-Line Client Issuing PUT to Quay [indicator]/services Endpoint · unlock with TL Creds
• 🔒 Quay /v2/_catalog Enumeration from Non-Internal Source · unlock with TL Creds
• 🔒 Quay Registry Authentication Failure Burst After Instance Key Removal · unlock with TL Creds
• 🔒 Quay Service Key Created/Rotated with No Expiration Date (CVE-2026-123710 Persistence) · unlock with TL Creds
• 🔒 Quay Bulk Repository Pulls by a Single Client Across Many Repositories · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5849.

Technical analysis

Impact includes exposure of private images and embedded secrets and overwriting of images that other systems pull.

CVE-2026-123710 affects the service key server (/keys endpoint) of Red Hat Quay. According to the Red Hat Bugzilla report (2568072, reported 2026-11-06), the key server validates only the signature, audience (aud) and issuer (iss) of the bearer JWT presented for key rotation, and discards the payload without checking what the token was actually granted. The /v2/auth endpoint issues anonymous tokens when anonymous access is enabled and takes the audience from the client-supplied 'service' parameter without pinning it, so such a token is accepted by the key server. In addition, replace_service_key copies the signer's approval to the new key, accepts a null expiration, and deletes the signing key, so the attacker's replacement key never expires and the legitimate instance key is removed as a side effect.

Once the attacker's key is trusted, they can mint registry tokens whose access claims map directly to pull, push and wildcard grants for any repository, including private ones. This exposes private images and any credentials or secrets embedded in them, and allows overwriting images that downstream systems later pull. The malicious key persists across registry restarts until removed, and the attacker's key can delete replacement instance keys, disrupting legitimate uploads and downloads. Red Hat states that disabling anonymous access does not protect deployments because any valid Quay account can exploit the flaw, and that resetting passwords or regenerating robot tokens does not invalidate an unauthorized signing key. Rogue key removal is not durable until a fixed build is deployed because attackers can reinstall keys.

Red Hat's advisory states that deployments where /keys is reachable by untrusted clients are affected, including standalone Quay (Podman/Docker), Quay deployed by the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift. No affected/fixed release list is published; Bugzilla confirms the issue against master commit 9226d3a5 and the 3.19-unstable image and states the logic has been present since the first public commit. Fixes were merged to the quay/quay repository on 2026-11-11 (PR #8056 to master, commit 094cfb0; backport PR #8057 to redhat-5.0, commit c95911d), together with a fix for CVE-2026-110697 (robot namespace prefix escaping). The fix requires a valid future expiration for service keys, prevents a rotated key's expiration from exceeding the signer's, scopes key replace/delete operations to the requested service, and limits keyserver JWT age and claim checks. The flaw was discovered by Dave O'Connor of Red Hat. Exploitation in the wild and a public PoC are not stated in the sources. Red Hat CVSS scores are marked preliminary; NVD showed N/A at time of review.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Persistence

T1098 Account Manipulation; T1525 Implant Internal Image

Collection

T1213 Data from Information Repositories

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1606 Forge Web Credentials

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Remediation

Patches

• Upstream fixes merged 2026-11-11: quay/quay PR #8056 (master) and PR #8057 (redhat-5.0 backport); no fixed released version identified by Red Hat at time of review

Immediate actions

• Restrict access to the /keys (service key server) endpoint at the proxy or load balancer so only trusted internal Quay components can reach it
• Review Quay audit logs for service_key_rotate and service_key_delete events, especially keys with a null (no) expiration date
• Remove any unrecognized or unauthorized approved service keys
• Re-check for re-installed rogue keys, since deleting a key is not durable until a fixed build is deployed

Workarounds

• Network-restrict /keys to trusted internal components
• Note: disabling anonymous access, resetting passwords, or regenerating robot tokens does NOT mitigate the flaw

Longer-term hardening

• Deploy a fixed Quay build once released by Red Hat, which includes service key lifecycle validation
• Rotate secrets and credentials embedded in private images if unauthorized key use is suspected
• Verify integrity/provenance of images pulled from the registry during the exposure window

Affected and fixed versions

• Red Hat — Red Hat Quay (standalone, Quay Operator on OpenShift, mirror registry for Red Hat OpenShift)
  Vulnerable versions: Deployments where /keys is reachable by untrusted clients; confirmed on master commit 9226d3a5 and 3.19-unstable; logic present since first public commit
  Fixed in: Not stated; fixes merged upstream 2026-11-11 (PR #8056, PR #8057)

Timeline

• 2026-11-06 Bugzilla 2568072 titled 'Red Hat Quay: unauthenticated registry signing-key takeover via service key rotation' tracks CVE-2026-123710; Red Hat later scores it preliminary CVSS 9.8 (cve.org also 9.8, NVD N/A).
• 2026-11-06 Flaw reported internally in Red Hat Bugzilla 2568072 (created 10:22 UTC; priority/severity urgent, assigned to Product Security), confirmed against master commit 9226d3a5 and 3.19-unstable image; logic present since the first public commit.
• 2026-11-11 Red Hat Solution 7149923 on identifying and remediating unauthorized signing keys last updated; Bugzilla entry last modified 15:17 UTC.
• 2026-11-11 Backport PR #8057 merged into the redhat-5.0 branch (commit c95911d).
• 2026-11-11 quay/quay PR #8056 'Fix CVE-2026-110697 and CVE-2026-123710' merged to master at 19:42 (commit 094cfb0), adding service key lifecycle validation, future-expiration requirement, service-scoped key replace/delete and hostname-pinned v2 token audience.
• 2026-11-11 quay/quay PR #8056 opened (commits 838b4ed robot namespace prefix escaping and 38c05aa keyserver service-key lifecycle validation), touching 11 files including locked-ioc-1, locked-ioc-3 and locked-ioc-5.
• 2026-11-12 quay/quay-service-tool PR #467 'bump embedded Quay for CVE-2026-110697' linked to the fix and still open, indicating downstream packaging of the fix is in progress.
• 2026-11-12 SecurityWeek publishes coverage of the critical CVSS 9.8 flaw, crediting discovery to Red Hat's Dave O'Connor; Red Hat advisory notes no fixed version or errata is named yet.

Sources cited

• Red Hat CVE-2026-123710 access.redhat.com · Advisory
• Red Hat Bugzilla 2568072: unauthenticated registry signing-key takeover via service key rotation bugzilla.redhat.com · Vendor report · 2026-11-06
• Red Hat Solution 7149923: Identifying and remediating unauthorized signing keys in Red Hat Quay access.redhat.com · Vendor report · 2026-11-11
• quay/quay PR #8056: Fix CVE-2026-110697 and CVE-2026-123710 GitHub · Code repository · 2026-11-11
• quay/quay PR #8057: backport of #8056 to redhat-5.0 GitHub · Code repository · 2026-11-11
• quay/quay-service-tool PR #467: bump embedded Quay for CVE-2026-110697 GitHub · Code repository · 2026-11-12
• Critical Red Hat Quay Vulnerability Could Expose Private Container Images (SecurityWeek) SecurityWeek · News · 2026-11-12

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)