Red Hat Quay Vulnerability CVE-2026-123710: Critical Flaw With No Fixed Version Yet, What Is Confirmed and How to Check if /keys Is Exposed

A flaw tracked as CVE-2026-123710 has been found in Red Hat Quay, and Red Hat says deployments where the /keys path can be reached by untrusted clients are affected. It is reported as critical, with a CVSS score of 9.8, and no fixed version exists yet. If your business runs Quay, your job this week is to find out whether /keys is exposed and to limit who can reach it.

What happened with the Red Hat Quay vulnerability

Red Hat's CVE page for CVE-2026-123710 says: "A flaw was found in Red Hat Quay." The same page says who is at risk: "Deployments where /keys is reachable by untrusted clients are affected." Red Hat files the weakness under CWE-1287.

Cyberpress reports that the issue became public on November 11, 2026, and that Red Hat credits Dave O'Connor with finding it. Cyberpress also reports that the Red Hat Bugzilla entry for the flaw, number 2568072, still shows status NEW and lists no fixed version.

Put simply: the flaw is public, it is rated about as severe as a flaw can be, and there is nothing to install yet.

What is confirmed and what is only reported

We opened two sources. We keep them apart below, because one is the vendor and the other is a news site.

The severity score and fix status come from Cyberpress, not from a Red Hat page we opened. They fit with the rest of the story, but check the Red Hat CVE page yourself before you make decisions based on them.

What a CVSS 9.8 score means for Quay

Cyberpress gives the full scoring vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain English:

• AV:N (network): the attack can come over the network. Nobody needs to be at the machine.
• AC:L (low complexity): no special conditions are needed for it to work.
• PR:N (no privileges): the attacker does not need an account or a login.
• UI:N (no user interaction): nobody on your side has to click anything.
• C:H/I:H/A:H: the scorer rated the possible impact on confidentiality, integrity and availability as high. That means reading data, changing data and disrupting service.

Put those together with Red Hat's wording about /keys and the risk is clear. If an untrusted client can reach that path, the scoring says an attacker with no login could do serious damage.

What is not known yet

The sources we checked leave several important questions open:

• Exactly what an attacker can do. Neither source we verified explains how the attack works or what an attacker gains, beyond the impact ratings in the score. Some headlines describe specific results. We could not confirm those details, so we are not repeating them.
• Which versions are affected. The only affected condition we can confirm is /keys being reachable by untrusted clients. We found no list of affected version numbers.
• Whether it is being exploited. Neither source says it is, and neither says it is not.
• When a fix will ship. No fixed version is listed and no date has been given.
• Whether there is an official workaround. We found no workaround published by Red Hat in the sources we checked.

Is my Red Hat Quay deployment affected?

Going by Red Hat's wording, you should treat your deployment as affected if two things are true: you run Red Hat Quay, and its /keys path can be reached by clients you do not trust. If Quay is open to the internet, or to a wide internal network that includes guest Wi-Fi, contractors or unmanaged devices, assume you are affected until you have checked.

If an agency, contractor or hosting provider runs Quay for you, ask them directly. A common gap is that nobody owns the update. We cover that in Who Is Patching the Software That Runs Your Business?.

What to do this week

There is no patch, so this week is about limiting exposure and getting ready.

When a fix does arrive, make sure it is actually installed and running, not just downloaded. We explain why that difference matters in Updated Is Not the Same as Patched.

Why this matters for a company network or website

If you use Quay to store the software your servers pull and run, then Quay is part of how your website, apps and internal tools get built and shipped. A flaw rated high for confidentiality, integrity and availability, open to attackers with no login, is a risk to the systems that depend on it.

Flaws with no fix yet are also the hardest kind to manage. There is no update to tick off, so the job is to know where the product runs and to keep internal paths off the open internet. That is the same lesson as other unpatched flaws we have covered. If you host your own systems, our self-hosting and infrastructure page explains how we approach keeping them reachable only by the people who need them.

Red Hat Quay vulnerability questions people are asking

What is CVE-2026-123710?

It is a flaw in Red Hat Quay. Red Hat says deployments where /keys is reachable by untrusted clients are affected. The weakness is classed as CWE-1287.

How serious is the Red Hat Quay flaw?

Cyberpress reports it as critical, with a CVSS v3.1 score of 9.8. The vector shows it can be attacked over the network with no login and no user interaction.

Is there a patch for CVE-2026-123710?

Not yet. Cyberpress reports that Bugzilla entry 2568072 still shows status NEW and lists no fixed version.

Which Red Hat Quay versions are affected?

No version list was published in the sources we checked. Red Hat's stated condition is that /keys can be reached by untrusted clients.

Is the Red Hat Quay vulnerability being exploited?

The sources we checked do not say either way. Treat that as unknown, not as safe.

When did the Quay flaw become public, and who found it?

Cyberpress reports it became public on November 11, 2026, and that Red Hat credits Dave O'Connor with the discovery.

The bigger lesson

Some critical flaws arrive before the fix does. When that happens, what protects you is knowing what you run and making sure internal paths are not open to anyone who asks.

If you want someone to check what your systems expose and keep them patched, see security hardening or get a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: Red Hat CVE-2026-123710; Cyberpress: Critical Red Hat Quay flaw.