Red Hat Quay: critical vuln

Project Quay

Critical Red Hat Quay flaw could expose private container images

Do this now

Check Red Hat's advisory for a Quay 3 fix and restrict access to Quay 3 registries from untrusted networks meanwhile.

First seen: 12 Nov 2026
Last update: 13 Nov 2026, 10:18 UTC
Versions per the CVE record from redhat, not the vendor: Project Quay 3.18.3
Project Quay 3.17.7
Project Quay 3.16.7
Project Quay 3.15.9
Project Quay 3.14.10
Project Quay 3.12.24
Project Quay 3.10.28
Project Quay 3.9.28
Red Hat Quay 3.10 1793993674
Red Hat Quay 3.12 1793993854
Red Hat Quay 3.14 1793993848
Red Hat Quay 3.15 1793993771
Red Hat Quay 3.16 1793993799
Red Hat Quay 3.17 1793993778
Red Hat Quay 3.18 1793993890
Red Hat Quay 3.9 1793993730
Identifiers: CVE-2026-110697
CVE-2026-123710
CVSS: 9.9
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Red Hat Quay: critical vuln
Severity: critical. Patch status: fix status unknown.
Affected: Project Quay
Versions per the CVE record from redhat, not the vendor: Project Quay 3.18.3, Project Quay 3.17.7, Project Quay 3.16.7, Project Quay 3.15.9, Project Quay 3.14.10, Project Quay 3.12.24, Project Quay 3.10.28, Project Quay 3.9.28, Red Hat Quay 3.10 1793993674, Red Hat Quay 3.12 1793993854, Red Hat Quay 3.14 1793993848, Red Hat Quay 3.15 1793993771, Red Hat Quay 3.16 1793993799, Red Hat Quay 3.17 1793993778, Red Hat Quay 3.18 1793993890, Red Hat Quay 3.9 1793993730
Ids: CVE-2026-110697, CVE-2026-123710

Critical Red Hat Quay flaw could expose private container images

## Steps
1. Search the repo, its CI and infra config for Project Quay. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from redhat, not the vendor: Project Quay: 3.18.x → 3.18.3; 3.17.x → 3.17.7; 3.16.x → 3.16.7; 3.15.x → 3.15.9; 3.14.x → 3.14.10; 3.12.x → 3.12.24; 3.10.x → 3.10.28; 3.9.28. Red Hat Quay 3.10: 1793993674. Red Hat Quay 3.12: 1793993854. Red Hat Quay 3.14: 1793993848. Red Hat Quay 3.15: 1793993771. Red Hat Quay 3.16: 1793993799. Red Hat Quay 3.17: 1793993778. Red Hat Quay 3.18: 1793993890. Red Hat Quay 3.9: 1793993730. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Project Quay 3.18.x | per the CVE record from redhat, not the vendor | 3.18.3 | restrict network access to it |
| Project Quay 3.17.x | per the CVE record from redhat, not the vendor | 3.17.7 | restrict network access to it |
| Project Quay 3.16.x | per the CVE record from redhat, not the vendor | 3.16.7 | restrict network access to it |
| Project Quay 3.15.x | per the CVE record from redhat, not the vendor | 3.15.9 | restrict network access to it |
| Project Quay 3.14.x | per the CVE record from redhat, not the vendor | 3.14.10 | restrict network access to it |
| Project Quay 3.12.x | per the CVE record from redhat, not the vendor | 3.12.24 | restrict network access to it |
| Project Quay 3.10.x | per the CVE record from redhat, not the vendor | 3.10.28 | restrict network access to it |
| Project Quay | per the CVE record from redhat, not the vendor | 3.9.28 | restrict network access to it |
| Red Hat Quay 3.10 | per the CVE record from redhat, not the vendor | 1793993674 | restrict network access to it |
| Red Hat Quay 3.12 | per the CVE record from redhat, not the vendor | 1793993854 | restrict network access to it |
| Red Hat Quay 3.14 | per the CVE record from redhat, not the vendor | 1793993848 | restrict network access to it |
| Red Hat Quay 3.15 | per the CVE record from redhat, not the vendor | 1793993771 | restrict network access to it |
| Red Hat Quay 3.16 | per the CVE record from redhat, not the vendor | 1793993799 | restrict network access to it |
| Red Hat Quay 3.17 | per the CVE record from redhat, not the vendor | 1793993778 | restrict network access to it |
| Red Hat Quay 3.18 | per the CVE record from redhat, not the vendor | 1793993890 | restrict network access to it |
| Red Hat Quay 3.9 | per the CVE record from redhat, not the vendor | 1793993730 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110697") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/
https://pwned.coffee/i/red-hat-quay-critical-vuln

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from redhat, not the vendor: Product Affected Version named Source
Project Quay 3.18.0 to before 3.18.3 3.18.3 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.17.0 to before 3.17.7 3.17.7 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.16.0 to before 3.16.7 3.16.7 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.15.0 to before 3.15.9 3.15.9 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.14.0 to before 3.14.10 3.14.10 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.12.0 to before 3.12.24 3.12.24 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay 3.10.0 to before 3.10.28 3.10.28 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay before 3.9.28 3.9.28 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.10 before 1793993674 1793993674 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.12 before 1793993854 1793993854 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.14 before 1793993848 1793993848 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.15 before 1793993771 1793993771 CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Score: CVSS 9.9 (critical). CVSS 3.1 9.9 (CNA redhat) for CVE-2026-110697
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
Project Quay	3.18.0 to before 3.18.3	3.18.3	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.17.0 to before 3.17.7	3.17.7	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.16.0 to before 3.16.7	3.16.7	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.15.0 to before 3.15.9	3.15.9	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.14.0 to before 3.14.10	3.14.10	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.12.0 to before 3.12.24	3.12.24	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	3.10.0 to before 3.10.28	3.10.28	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Project Quay	before 3.9.28	3.9.28	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.10	before 1793993674	1793993674	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.12	before 1793993854	1793993854	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.14	before 1793993848	1793993848	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov
Red Hat Quay 3.15	before 1793993771	1793993771	CVE record (CNA) per the CVE record from redhat, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

securityweek.com: Critical Red Hat Quay Vulnerability Could Expose Private Container Images

Follow on X

Totalone very hot coffee