Red Hat has disclosed two critical vulnerabilities in its Quay container registry software, identified as CVE-2026-123710 and CVE-2026-110697. These vulnerabilities have CVSS scores of 9.8 and 9.9, respectively, indicating their severity.
CVE-2026-123710 allows attackers to access private container images and modify repository content. This flaw can be exploited by unauthenticated attackers when anonymous access is enabled. Even with anonymous access disabled, any valid Quay account can exploit the vulnerability.
The exploitation of CVE-2026-123710 involves taking over registry token signing, allowing attackers to generate tokens with read and write access to any repository, bypassing normal access restrictions. The malicious signing key can be configured without an expiration date, persisting through registry restarts unless manually removed.
Both vulnerabilities affect all versions of Quay 3 and Quay 5. Red Hat recommends restricting access to the key-management service and reviewing logs for any suspicious key changes as a mitigation measure.
The vulnerabilities were discovered by Red Hat's Dave O'Connor. The confirmed exploitation status highlights the urgency for users to apply recommended security measures to protect their systems.