# CVE-2026-123710: Red Hat Quay unauthenticated service key takeover

Source: https://junglewise.ai/threats/cve-2026-123710-a-flaw-was-found-in-red-hat-quay-an-unauthenticated-client-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123710 · Severity: critical · CVSS 9.8 · Published 2026-11-11

Red Hat Quay is a container image registry that stores and manages Docker images for organizations. A critical flaw allows an attacker without any credentials to forge valid signing keys and obtain unauthorized read and write access to all private images in the registry. An attacker could steal proprietary container images or inject malicious code into production deployments.

Technologies: [Red Hat Quay](https://junglewise.ai/threats/technologies/quay-3-12). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-123710 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123710 being exploited in the wild.

**How severe is CVE-2026-123710?** Critical severity, with a CVSS score of 9.8, published 11 November 2026.

**Which products and versions are affected?** Red Hat Quay.

**Is there a fix for CVE-2026-123710?** No fixed version is recorded yet. Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with null expiration_date and remove any unrecognized approved service keys.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123710 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-123710?** Check whether you run Red Hat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with null expiration_date and remove any unrecognized approved service keys.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}]

## Technical details

The service key rotation endpoint (/keys) validates JWT tokens only by checking their signature against approved keys and audience/issuer claims, but does not verify that the token is a rotation credential. An attacker can obtain an anonymous registry token from /v2/auth with a controlled audience and present it to /keys to install a new signing key with no expiry. Since the endpoint is network-accessible and requires no authentication, any unauthenticated client can exploit this to forge registry tokens accepted for any repository.

## Affected products

- Red Hat Quay

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-123710](https://access.redhat.com/security/cve/CVE-2026-123710)

## Related threats

- [Red Hat Quay SQL injection in robot account listing](https://junglewise.ai/threats/cve-2026-110697-a-flaw-was-found-in-quay-where-the-robot-account-listing)
- [Quay webhook hostname blacklist bypass leading to SSRF](https://junglewise.ai/threats/cve-2026-85471-a-flaw-was-found-in-quay-an-authenticated-repository)
- [Red Hat Quay build trigger API authorization bypass](https://junglewise.ai/threats/cve-2026-109194-a-flaw-was-found-in-red-hat-quay-the-build-trigger-management)
- [Red Hat Quay privilege escalation in build trigger API](https://junglewise.ai/threats/cve-2026-105447-a-flaw-was-found-in-quay-when-handling-build-trigger-requests)
- [Red Hat Quay DOM-based XSS via unvalidated redirect](https://junglewise.ai/threats/cve-2026-102576-a-flaw-was-found-in-quay-a-remote-attacker-could-trick-a-user)