# Critical Red Hat Quay Vulnerability (CVE-2026-123710) Allows Unauthenticated Registry Signing-Key Takeover and Exposure of Private Container Images

> A critical flaw in Red Hat Quay's service key server lets an unauthenticated attacker (or any valid Quay account) install an attacker-controlled, never-expiring signing key via the key rotation mechanism and forge registry tokens with read/write access to every repository. Impact includes exposure of private images and embedded secrets and overwriting of images that other systems pull.

- **Published:** 2026-11-12T10:16:15Z
- **Last reviewed:** 2026-11-12T10:16:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5849
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5849.png
- **ID:** TL-2026-5849
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12
- **CVEs:** CVE-2026-123710, CVE-2026-110697

## Description

CVE-2026-123710 affects the service key server (/keys endpoint) of Red Hat Quay. According to the Red Hat Bugzilla report (2568072, reported 2026-11-06), the key server validates only the signature, audience (aud) and issuer (iss) of the bearer JWT presented for key rotation, and discards the payload without checking what the token was actually granted. The /v2/auth endpoint issues anonymous tokens when anonymous access is enabled and takes the audience from the client-supplied 'service' parameter without pinning it, so such a token is accepted by the key server. In addition, replace_service_key copies the signer's approval to the new key, accepts a null expiration, and deletes the signing key, so the attacker's replacement key never expires and the legitimate instance key is removed as a side effect.

Once the attacker's key is trusted, they can mint registry tokens whose access claims map directly to pull, push and wildcard grants for any repository, including private ones. This exposes private images and any credentials or secrets embedded in them, and allows overwriting images that downstream systems later pull. The malicious key persists across registry restarts until removed, and the attacker's key can delete replacement instance keys, disrupting legitimate uploads and downloads. Red Hat states that disabling anonymous access does not protect deployments because any valid Quay account can exploit the flaw, and that resetting passwords or regenerating robot tokens does not invalidate an unauthorized signing key. Rogue key removal is not durable until a fixed build is deployed because attackers can reinstall keys.

Red Hat's advisory states that deployments where /keys is reachable by untrusted clients are affected, including standalone Quay (Podman/Docker), Quay deployed by the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift. No affected/fixed release list is published; Bugzilla confirms the issue against master commit 9226d3a5 and the 3.19-unstable image and states the logic has been present since the first public commit. Fixes were merged to the quay/quay repository on 2026-11-11 (PR #8056 to master, commit 094cfb0; backport PR #8057 to redhat-5.0, commit c95911d), together with a fix for CVE-2026-110697 (robot namespace prefix escaping). The fix requires a valid future expiration for service keys, prevents a rotated key's expiration from exceeding the signer's, scopes key replace/delete operations to the requested service, and limits keyserver JWT age and claim checks. The flaw was discovered by Dave O'Connor of Red Hat. Exploitation in the wild and a public PoC are not stated in the sources. Red Hat CVSS scores are marked preliminary; NVD showed N/A at time of review.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1606 Forge Web Credentials
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1213 Data from Information Repositories
- T1525 Implant Internal Image
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1565.001 Data Manipulation: Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Red Hat Quay Service Key Server /keys Write Requests from Non-Internal Sources (CVE-2026-123710)** (`TL-2026-5849-SPL-001`)

Detects PUT/POST/DELETE requests to the Red Hat Quay service key server (/keys/services/quay/keys/...) originating from non-RFC1918 addresses. CVE-2026-123710 lets an anonymous or low-privilege bearer JWT rotate service keys through this endpoint, installing an attacker-controlled never-expiring signing key (TL-2026-5849, T1190, T1606). Legitimate key rotation is performed only by trusted internal Quay components, so any external write is high-fidelity.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606
- **Data sources:** nginx/proxy access logs (index=web sourcetype=access_combined), CommonSecurityLog (WAF/proxy CEF), web server access logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-24h uri_path="/keys/services/*" method IN ("PUT","POST","DELETE") | where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip)) | stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(status) as statuses values(uri_path) as paths by clientip host | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
CommonSecurityLog | where TimeGenerated > ago(24h) | where RequestURL has "/keys/services/" | where RequestMethod in~ ("PUT", "POST", "DELETE") | where not(ipv4_is_private(SourceIP)) | project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, Activity | order by TimeGenerated desc
```

### Sigma

```yaml
title: Red Hat Quay Service Key Write Request from Non-Internal Source (CVE-2026-123710)
id: 7c1e4f52-3a9b-4d68-9e21-5b0a8c6d1f01
status: experimental
description: Detects PUT/POST/DELETE requests to the Quay service key server /keys/services/ path from non-RFC1918 clients, the key rotation call abused by CVE-2026-123710 to install a rogue signing key.
references:
    - https://access.redhat.com/security/cve/cve-2026-123710
    - https://bugzilla.redhat.com/show_bug.cgi?id=2568072
    - https://github.com/quay/quay/pull/8056
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - cve.2026.123710
logsource:
    category: webserver
detection:
    selection:
        cs-method:
            - 'PUT'
            - 'POST'
            - 'DELETE'
        cs-uri-stem|contains: '/keys/services/'
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Quay components or a load balancer health proxy reaching the key server through a public or NAT address
level: high
```

**Known false positives:**

- Quay Operator or sibling Quay pods calling /keys via a NAT or public address
- Authorized penetration test or vulnerability scan against the registry

**Tuning notes:** Replace the RFC1918 ranges with your actual Quay component, ingress and load-balancer CIDRs. Adjust index/sourcetype to where the Quay ingress/nginx logs land. If the proxy rewrites client IPs, use the X-Forwarded-For field instead of clientip.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Quay [indicator] Non-FQDN Audience Request Followed by [indicator] Write from Same Source (locked: unlock with TL Creds)
- Quay Image Push or Tag Move by Previously Unseen Identity/Source (Image Overwrite) (locked: unlock with TL Creds)
- Quay Signing Key Rotate and Delete Within 10 Minutes (Legitimate Instance Key Removed) (locked: unlock with TL Creds)
- Command-Line Client Issuing PUT to Quay [indicator]/services Endpoint (locked: unlock with TL Creds)
- Quay /v2/_catalog Enumeration from Non-Internal Source (locked: unlock with TL Creds)
- Quay Registry Authentication Failure Burst After Instance Key Removal (locked: unlock with TL Creds)
- Quay Service Key Created/Rotated with No Expiration Date (CVE-2026-123710 Persistence) (locked: unlock with TL Creds)
- Quay Bulk Repository Pulls by a Single Client Across Many Repositories (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Red Hat Quay Vulnerability Could Expose Private Container Images (SecurityWeek)](https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/)
- [Red Hat CVE-2026-123710](https://access.redhat.com/security/cve/cve-2026-123710)
- [Red Hat Bugzilla 2568072: unauthenticated registry signing-key takeover via service key rotation](https://bugzilla.redhat.com/show_bug.cgi?id=2568072)
- [quay/quay PR #8056: Fix CVE-2026-110697 and CVE-2026-123710](https://github.com/quay/quay/pull/8056)
- [quay/quay PR #8057: backport of #8056 to redhat-5.0](https://github.com/quay/quay/pull/8057)
- [quay/quay-service-tool PR #467: bump embedded Quay for CVE-2026-110697](https://github.com/quay/quay-service-tool/pull/467)
- [Red Hat Solution 7149923: Identifying and remediating unauthorized signing keys in Red Hat Quay](https://access.redhat.com/solutions/7149923)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5849