Critical Red Hat Quay Vulnerability Could Expose Private Container Images
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 12 Nov 2026, 09:33 UTC
What to do
AI-suggested
Red Hat advises restricting access to the key-management service, reviewing logs for suspicious key changes, and removing unauthorized signing keys. Disabling anonymous access or changing passwords and robot tokens does not mitigate the vulnerability. Since attackers can reinstall malicious keys until a fix is deployed, organizations should monitor closely and apply the fixes merged into the project repository once an official release is available.
Description
A critical vulnerability in Red Hat Quay allows unauthenticated attackers to take over registry token signing, enabling them to access private container images, overwrite repositories, and maintain persistent access. The flaw affects deployments where the service managing signing keys is accessible to untrusted clients. Attackers can install malicious signing keys that survive restarts and bypass normal access controls. Disabling anonymous access or changing passwords does not mitigate the risk. Fixes were merged into the project repository on November 11, 2026, but no fixed version is yet officially released.