Security AlertCritical
Critical Red Hat Quay flaws can expose private container images
Nov 12, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Red Hat Quay has two critical flaws that can let attackers read, overwrite, or steal private container images. Red Hat says fixed builds are available for eight Quay 3 branches for one issue.
Key points
- CVE-2026-123710 can let an attacker add a trusted signing key.
- Quay 3 and Quay 5 are affected, including OpenShift and mirror registry installs.
- Another flaw, CVE-2026-110697, can expose other tenants’ robot tokens.
Why it matters
Businesses using Quay could expose private images, secrets, or deployment systems. That can disrupt software delivery and create supply-chain risk. Update quickly and review key-management access.
Who’s affected: Red Hat Quay registries and container images
What to do
- Patch Quay as soon as fixed builds are available.
- Restrict access to the key-management service.
- Review logs for suspicious key changes.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.