A critical vulnerability tracked as CVE-2026-123710 in Red Hat Quay lets an unauthenticated attacker take over the registry token-signing service and gain read-write access to any repository. The flaw resides in the key-management service, which is reachable by untrusted clients; when anonymous access is enabled, an attacker can obtain a token, exploit a weak key rotation mechanism and install a malicious signing key that persists across restarts and has no expiration. The attacker-generated tokens bypass normal access controls, exposing private container images, embedded credentials and allowing overwriting of images. Red Hat warns that disabling anonymous access does not protect you, because any valid Quay account can still exploit the issue, and that changing passwords or regenerating robot tokens does not invalidate the rogue key. Fixes for this flaw and CVE-2026-110697 were merged into the project’s GitHub repository on November 11, though no fixed version is identified in the advisory. 1