Misconfigured Anonymous Access Exposes Container Registries to Full Hijack
Written by AI from the linked story. Not reviewed by an editor. How this works
A critical flaw in Red Hat Quay (CVE-2026-123710, CVSS 9.8) demonstrates how a permissive default feature flag—FEATURE_ANONYMOUS_ACCESS—combined with an unprotected cryptographic endpoint can hand attackers the keys to an entire container registry. By injecting malicious signing keys via the /keys endpoint, unauthenticated adversaries can gain read/write control over private images and manipulate repository tags, poisoning any downstream software built from those images. This matters far beyond the registry itself: compromised container images propagate silently into CI/CD pipelines, production deployments, and customer environments. The incident underscores that cryptographic trust mechanisms are only as strong as the access controls protecting them.
Tactical Insight
Immediate actions
- Block unauthenticated access to the /keys endpoint at the proxy or load balancer layer until a patched Quay version is available.
- Audit all registered service keys in your Quay instance and revoke any that cannot be positively verified as legitimate.
- Disable FEATURE_ANONYMOUS_ACCESS unless there is an explicit, documented business requirement for it.
Long-term improvements
- Establish a hardened baseline configuration for all container registry deployments and enforce it through infrastructure-as-code and automated compliance checks.
- Integrate container image signing verification (e.g., Sigstore/Cosign) into every CI/CD pipeline so tampered images are rejected before deployment.
- Apply the principle of least privilege to all registry API endpoints, requiring authentication and role-based authorization for any operation that reads or writes cryptographic material.
Detection measures
- Enable detailed audit logging on the /keys endpoint and alert on any key registration or modification event originating from an unauthenticated or unexpected source.
- Deploy continuous vulnerability scanning against container registry infrastructure to surface critical CVEs within hours of disclosure.
- Monitor image tag mutation events and alert on unexpected tag reassignments, which are a key indicator of supply-chain tampering.