CVE-2026-123710 Identifying and remediating unauthorized signing keys in Red Hat Quay

Issue

A flaw in the Quay key server lets an unauthorized client install a signing key that Quay trusts. Quay uses these keys to sign the tokens that authorize pushes and pulls. Anyone holding a trusted key can create their own tokens and use them on any repository on the registry, including private repositories that belong to other users and organizations.

Someone who exploits this flaw can:

• Pull private images, along with any secrets or credentials stored in them.
• Push or overwrite images, which affects every system that later pulls them.
• Keep their access. The installed key can be set to never expire, and it survives restarts until someone removes it.
• Break normal pushes and pulls by deleting the keys that running Quay instances use. Clients then get authentication required or unauthorized errors even though their credentials haven't changed.

Anonymous access is on by default, and with it on, an attacker doesn't need an account. Turning off anonymous access doesn't protect you, because any valid Quay account can still exploit the flaw.

Resetting passwords or regenerating robot tokens does not revoke an unauthorized signing key.