Quick answers
- Is CVE-2026-123710 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123710 being exploited in the wild.
- How severe is CVE-2026-123710?
- Critical severity, with a CVSS score of 9.8, published 11 November 2026.
- Which products and versions are affected?
- Red Hat Quay.
- Is there a fix for CVE-2026-123710?
- No fixed version is recorded yet. Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with null expiration_date and remove any unrecognized approved service keys.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-123710 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-123710?
- Check whether you run Red Hat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with null expiration_date and remove any unrecognized approved service keys.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}]
Technical details
The service key rotation endpoint (/keys) validates JWT tokens only by checking their signature against approved keys and audience/issuer claims, but does not verify that the token is a rotation credential. An attacker can obtain an anonymous registry token from /v2/auth with a controlled audience and present it to /keys to install a new signing key with no expiry. Since the endpoint is network-accessible and requires no authentication, any unauthenticated client can exploit this to forge registry tokens accepted for any repository.
Affected products
- Red Hat Quay