Ethical Hacking News
Red Hat Quay has been hit with a critical flaw that allows attackers to read and overwrite private container images in every repository. This vulnerability, tracked as CVE-2026-123710, has a CVSS score of 9.8 and highlights the ongoing threat of cloud-based security vulnerabilities. To mitigate this risk, Red Hat has released fixed builds for eight Quay 3 branches, but users are urged to take proactive steps to protect their container security.
Red Hat Quay, a widely used container registry, has a critical flaw (CVE-2026-123710) that allows attackers to read and overwrite private container images. The vulnerability has a CVSS score of 9.8, compromising the security of individual organizations and entire ecosystems. The flaw was discovered by Red Hat's own security team, highlighting the importance of rigorous security auditing and code review. The vulnerability can be exploited even after password resets and changes to the robot token, making it a particularly insidious threat. A second critical flaw (CVE-2026-110697) was also disclosed, allowing attackers to steal robot account tokens and compromise images.
In a disturbing revelation that highlights the ever-evolving landscape of cloud-based security threats, a critical flaw has been discovered in the Red Hat Quay, a container registry that is widely used in the industry. This vulnerability, tracked as CVE-2026-123710, with a CVSS score of 9.8, allows an attacker who can access a Quay registry to read and overwrite all private container images in every repository. The impact of this flaw is far-reaching, as it compromises the security of not only individual organizations but also entire ecosystems that rely on Quay for container management.
The discovery of this critical flaw is attributed to Red Hat's own team of security experts, led by Dave O'Connor. The logic behind this vulnerability has been present in Quay since its first public commit, according to the bug report. This raises questions about the diligence and thoroughness of the testing process, highlighting the importance of rigorous security auditing and code review.
According to the article, the flaw in question allows an attacker to add their own key to the keys that Quay trusts, effectively bypassing the standard authentication and authorization mechanisms. With this newfound access, an attacker can not only retrieve private images but also push or overwrite images, resulting in a domino effect of compromised systems that rely on these images.
The vulnerability is not limited to standalone Quay installations but also extends to environments where Quay is deployed by the Quay Operator on OpenShift. Furthermore, the mirror registry for Red Hat OpenShift is also affected, putting a significant chunk of the industry's cloud-based infrastructure at risk.
Red Hat has released fixed builds for eight Quay 3 branches, but the company warns that turning off anonymous access does not provide adequate protection. The flaw can be exploited even after password resets and changes to the robot token, making it a particularly insidious threat. The company recommends several steps to mitigate this risk, including blocking the /keys endpoint for everything except trusted internal components, searching for service_key_rotate and service_key_delete events, and removing any approved service keys that are not recognized.
A second critical flaw, CVE-2026-110697, with a CVSS score of 9.9, was also disclosed at the same time. This flaw allows a Quay user who can create a namespace to steal other tenants' robot account tokens and use them to read, push, or overwrite those tenants' images. This flaw is in the code that lists robot accounts and exploits a SQL LIKE pattern vulnerability, making it particularly easy to exploit.
The discovery of these critical flaws in Red Hat Quay highlights the ongoing cat-and-mouse game between attackers and defenders in the world of cloud-based security. As the industry continues to evolve and rely more heavily on cloud-based infrastructure, it is essential that vendors and users alike prioritize security and take proactive steps to mitigate these types of vulnerabilities.
In conclusion, the critical Red Hat Quay flaw is a wake-up call for the industry, emphasizing the need for rigorous security testing and code review. As the threat landscape continues to evolve, it is crucial that users and vendors remain vigilant and proactive in their efforts to protect cloud-based container security.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Red-Hat-Quay-Flaw-An-Unprecedented-Threat-to-Cloud-Based-Container-Security-ehn.shtml
https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html
Published: Thu Nov 12 13:26:14 2026 by llama3.2 3B Q4_K_M
