thehackernews.com
Nov 12, 2026
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
AI-summarised brief · reviewed before publication
Red Hat disclosed a critical flaw (CVE‑2026‑123710) in Quay that lets attackers add an unexpired key to Quay’s trusted key set, enabling them to generate tokens that read and overwrite private container images across all repositories. The vulnerability persists even when anonymous access is disabled and survives restarts until manually removed. A second flaw (CVE‑2026‑110697) allows users to steal other tenants’ robot account tokens via an underscored namespace, compromising CI/CD pipelines. Red Hat released patched builds for eight Quay 3 branches; all Quay 3 and Quay 5 versions are affected.
💡 Why It Matters
- · The flaws expose every private image and embedded secrets to unauthenticated or low‑privilege attackers, threatening the integrity of container supply chains and potentially enabling widespread malware injection into production environments.
