Threat video1:00
CVE-2026-123710 Quay Key Takeover: Detection & IOCs
An unauthenticated flaw in Red Hat Quay lets attackers install a rogue signing key. Hunt it with 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for Critical Red Hat Quay Vulnerability (CVE-2026-123710) Allows… →
Chapters
- 0:00The hookCritical Quay flaw lets attackers install signing keys.
- 0:04The storyRed Hat's Dave O'Connor found it.
- 0:10Attack pathReportedly, the key server needs no login.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise11 indicators to hunt: 3 URLs, 5 paths and 3 package names.
- 0:39MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Restrict access to the /keys endpoint at the proxy.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Critical Quay flaw lets attackers install signing keys.
0:05Red Hat's Dave O'Connor found it.
0:07Fixes merged; no fixed version is named.
0:10Reportedly, the key server needs no login.
0:13Then a never-expiring attacker key is installed.
0:16That key forges tokens for every repository.
0:20Private images and embedded secrets are exposed.
0:23Overwritten images reach downstream systems.
0:28No threat actor is attributed. Confidence: low.
0:3311 indicators to hunt: 3 URLs, 5 paths and 3 package names.
0:3910 ATT&CK techniques, from initial access to impact.
0:444 steps now: Restrict access to the /keys endpoint at the proxy.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.