Threats tagged 'ghsa-jw94-v4wp-236w'

A critical vulnerability in Red Hat Quay allows an unauthenticated attacker to obtain an anonymous registry token with a controlled audience and use it to install their own signing key without expiry via the service key rotation endpoint. This enables the attacker to create registry tokens accepted for any repository, granting read and write access to private images and the ability to replace repository tags. The flaw arises because the key rotation endpoint authenticates callers only by verifying the JWT signature from an approved key, without validating that the token is a legitimate rotation credential. Deployments exposing the /keys endpoint to untrusted clients are affected.