# Critical Red Hat Quay Vulnerabilities Expose Private Container Images Two high-severity flaws allow attackers to bypass authentication and compromise container registries. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/5a4cc154-fbd7-4e8d-8e13-0212f73bda93 ## Critical Quay Registry Flaws Red Hat Quay faces two critical vulnerabilities, CVE-2026-123710 and CVE-2026-110697, impacting container security. These flaws allow unauthorized access, image manipulation, and credential theft across private repositories. With CVSS scores of 9.8 and 9.9, these issues represent a severe risk to any organization utilizing Quay for container image management and deployment. ## Token Signing Mechanism Failure The flaw CVE-2026-123710 enables attackers to inject their own trusted keys into the Quay registry. By exploiting the key server's failure to validate token rotation, malicious actors can sign tokens for any repository. These tokens grant full read and write access, bypassing standard authentication protocols regardless of anonymous access settings. ## Persistent Unauthorized Image Access Once a malicious key is planted, it persists through system restarts and password resets. Attackers can retrieve private images, extract embedded secrets, or overwrite existing container images. This persistence ensures that compromised images propagate to all systems pulling from the registry, potentially poisoning downstream CI/CD pipelines and production environments. ## Namespace Hijacking via SQL The second vulnerability, CVE-2026-110697, exploits improper SQL LIKE pattern handling in robot account lookups. By creating a namespace containing an underscore, an attacker can match and access other tenants' robot account tokens. This allows unauthorized parties to manipulate images belonging to other users without requiring any elevated administrative privileges. ## OpenShift Integration Risks When Quay serves as the integrated registry for OpenShift, these vulnerabilities pose a direct threat to automated workflows. Stolen robot credentials can be leveraged to inject malicious code into CI/CD pipelines. This integration makes the registry a high-value target for attackers seeking to compromise the entire software supply chain. ## Scope of Affected Versions Red Hat confirms that all versions of Quay 3 and Quay 5 are affected by these critical flaws. The vulnerability impacts standalone installations, Quay deployed via the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift. Any instance reachable by untrusted clients remains exposed until patches are applied. ## Immediate Mitigation Strategies Until updates are deployed, administrators should restrict the creation of namespaces containing underscores. Organizations must rotate robot tokens for namespaces potentially impacted by pattern matching and monitor for anomalous push or pull activity. These measures provide temporary risk reduction but do not fully remediate the underlying architectural security gaps. ## Remediation and Future Security The upstream fix enforces mandatory expiry dates for keys and adds critical rotation checks to the token issuance process. Moving forward, security teams must prioritize identity visibility and threat detection within their SOC. Addressing these identity gaps is essential to preventing future exploitation of machine-to-machine authentication mechanisms in containerized environments. ## Sources covering this story - https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._