Red Hat disclosed two serious flaws in Quay; the first, CVE-2026-123710 (CVSS 9.8), can let an attacker add a persistent trusted key, access every repository, and read, upload, or replace packages.
Systems that later fetch altered packages may be affected.
The case highlights how trust in a package store can shape downstream software workflows.
Access to all private packages
The first issue allows an attacker to add their own access key to the list of keys accepted by Quay. The key has no expiration date and can grant access to any storage space on the service. This allows the attacker to read private packages and the secrets or login details stored within them. They can also upload new packages or replace existing ones. The change can affect any system that later downloads the package.
Anonymous access is enabled by default in Quay. As long as it is enabled, no account is required to exploit the issue. If it is disabled, a valid account is required. However, according to Red Hat, disabling anonymous access does not protect against the issue.
The key remains active across reboots until removed. It can also be used to delete keys needed by Quay installations. Normal packet uploads and downloads may then fail. Even if passwords or automated account access keys are changed, a key that has already been added will still work.
Risk to accounts of other organizations
The second issue concerns users who can create named spaces in Quay. If they use a specific name that contains an underscore, they can expose another organization's automated access accounts and steal their access keys. With these, they can read, upload, or replace packages in the organization. No special elevated privileges are required, and the victim does not need to do anything.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Citrix fixes 12 issues that could disrupt services or give access to limited resources
↗
According to Red Hat, if Quay is integrated with OpenShift, stolen keys could allow malicious packages to be injected into automated software build and deployment processes. Deleting the space created by the attacker could also delete the associated automated accounts and disrupt systems that rely on them.
Which facilities are affected?
Red Hat says that all Quay 3 and Quay 5 versions are affected. For the first issue, the list includes standalone installations, the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift. According to the company, any Quay installation that can be accessed by untrusted users is at risk, even if it is only used internally.
Red Hat's fixes
Red Hat has released fixes for eight Quay 3 release series. For the second issue, the related update page lists the same eight releases as fixed and says that Quay.io has already been fixed. However, the release announcements do not mention the second issue.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)