[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5xIQQEOTmqbDeX4xNXlbGvuT2iDreMXxusUBnc9swZg":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"bdfe6e6f-5d5b-4d5e-abe4-21b38e067bf3","Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries","critical-red-hat-quay-vulnerability-allows-unauthenticated-attackers-to-hijack-c-06455e","A critical flaw in Red Hat Quay lets anyone who can reach a registry’s key server take over its token signing. The bug is tracked as CVE-2026-123710 and carries a CVSS score of 9.8, according to Red Hat’s advisory and the National Vulnerability Database. Red Hat published it on November 11, 2026. Quay is an […] The post Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries appeared first on Cyber Security News.","A critical vulnerability in Red Hat Quay container registries (CVE-2026-123710, CVSS 9.8) allows unauthenticated attackers to hijack token signing by manipulating the \u002Fkeys endpoint when FEATURE_ANONYMOUS_ACCESS is enabled. The flaw permits attackers to inject malicious signing keys, gain read\u002Fwrite access to private container images, and swap repository tags, potentially compromising the entire software supply chain. Red Hat recommends immediately restricting \u002Fkeys access at the proxy\u002Fload balancer level and auditing for rogue service keys until a patched version is released.","Critical Red Hat Quay vulnerability (CVE-2026-123710, CVSS 9.8) allows unauthenticated token hijacking.","https:\u002F\u002Fcybersecuritynews.com\u002Fred-hat-quay-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FRed-Hat-Quay-vulnerability.webp","2026-11-12T13:57:37+00:00","2026-11-12T14:00:25.537858+00:00",9,[17,20,23,25],{"name":18,"type":19},"Red Hat","vendor",{"name":21,"type":22},"Red Hat Quay","product",{"name":24,"type":22},"Quay 3",{"name":26,"type":22},"Quay 5","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-123710","Critical vulnerability in Red Hat Quay allowing unauthenticated token hijacking",[18,21,24],{"controls":55,"vendors":142},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,105],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":86,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":114,"name":115,"problem":116,"products":117},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"misconfigured-anonymous-access-exposes-container-registries-to-full-hijack","Misconfigured Anonymous Access Exposes Container Registries to Full Hijack","A critical flaw in Red Hat Quay (CVE-2026-123710, CVSS 9.8) demonstrates how a permissive default feature flag—FEATURE_ANONYMOUS_ACCESS—combined with an unprotected cryptographic endpoint can hand attackers the keys to an entire container registry. By injecting malicious signing keys via the \u002Fkeys endpoint, unauthenticated adversaries can gain read\u002Fwrite control over private images and manipulate repository tags, poisoning any downstream software built from those images. This matters far beyond the registry itself: compromised container images propagate silently into CI\u002FCD pipelines, production deployments, and customer environments. The incident underscores that cryptographic trust mechanisms are only as strong as the access controls protecting them.",[148,149,150,151,152],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIS2 Article 21(2)(d)","MITRE ATT&CK T1553.002: Subvert Trust Controls: Code Signing",{"NIS2 Article 21(2)(d)":154,"NIST SP 800-53 AC-3: Access Enforcement":155,"MITRE ATT&CK T1553.002: Subvert Trust Controls: Code Signing":156,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":157,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":158},"This point requires security measures addressing supply chain risks; the ability to swap container image tags and inject malicious images into downstream pipelines is precisely the supply-chain attack scenario NIS2 Article 21(2)(d) is designed to prevent.","AC-3 requires that the system enforce approved authorizations for all access to resources; enforcing authentication before allowing any interaction with the cryptographic \u002Fkeys endpoint would have prevented unauthenticated key injection.","This technique describes adversaries undermining code-signing mechanisms to make malicious artifacts appear legitimate, which is exactly what injecting rogue signing keys into the Quay \u002Fkeys endpoint achieves.","SC-12 requires protecting cryptographic keys throughout their lifecycle; controlling who can register or modify signing keys is a direct requirement of this control that was violated by the exposed \u002Fkeys endpoint.","This control requires establishing and maintaining secure configurations; disabling FEATURE_ANONYMOUS_ACCESS and restricting the \u002Fkeys endpoint to authenticated callers is exactly the kind of hardened baseline it mandates."]