Red Hat Quayの署名鍵を認証なしで奪える脆弱性、回避策あり

CVE-2026-123710 First seen on SecPulse Nov 12, 00:02

Summary

Red Hat Quayに、認証なしで攻撃者の署名鍵を登録でき、非公開イメージの読み書きやタグの置き換えに至る脆弱性が公表されました。/keysに信頼できないクライアントが届く環境では、プロキシでの遮断とログの確認を今すぐ行ってください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Red Hat	Red HatRed Hat Quay 3	—	Not listed
Red Hat	Red HatRed Hat Quay 5	—	Not listed
Red Hat	Red HatRed Hat Quay 3.10	—	Not listed
Red Hat	Red HatRed Hat Quay 3.14	—	Not listed
Red Hat	Red HatRed Hat Quay 3.15	—	Not listed
Red Hat	Red HatRed Hat Quay 3.16	—	Not listed
Red Hat	Red HatRed Hat Quay 3.18	—	Not listed
Red Hat	Red HatRed Hat Quay 3.9	—	Not listed
Red Hat	Red HatRed Hat Quay 3.12	—	Not listed
Red Hat	Red HatRed Hat Quay 3.17	—	Not listed
Project Quay	Project Quayquay	< 3.9.28→ 3.9.28 ≥ 3.10.0, < 3.10.28→ 3.10.28 ≥ 3.12.0, < 3.12.24→ 3.12.24 ≥ 3.14.0, < 3.14.10→ 3.14.10 ≥ 3.15.0, < 3.15.9→ 3.15.9 ≥ 3.16.0, < 3.16.7→ 3.16.7 ≥ 3.17.0, < 3.17.7→ 3.17.7 ≥ 3.18.0, < 3.18.3→ 3.18.3	3.9.28 3.10.28 3.12.24 3.14.10 3.15.9 3.16.7 3.17.7 3.18.3

Original description The description as published by the source.

A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 00:02
GHSA: GHSA-jw94-v4wp-236w
CWE: CWE-1287

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-1287

Vendors

Red Hat

All

Red Hat Quay 3 Red Hat Quay 5 Red Hat Quay 310 Red Hat Quay 314 Red Hat Quay 315 Red Hat Quay 316 Red Hat Quay 318 Red Hat Quay 39 Red Hat Quay 312 Red Hat Quay 317 Project Quay Quay

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database11:18
GitHub Security Advisories (Global)09:32
Red Hat Security AdvisoriesNov 12, 09:25
CVE.org (CVE Program・cvelistV5)09:21