{"metadata": {"vulnerability": "CVE-2026-123710", "count": 19, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-06T09:44:27.114Z", "date_only": false, "value": "2026-11-06T09:44:27.114Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.timeline.0.time", "text": "Reported to Red Hat."}, {"timestamp": "2026-11-06T10:23:55.509Z", "date_only": false, "value": "2026-11-06T10:23:55.509Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-123710", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-11T14:00:00Z", "date_only": false, "value": "2026-11-11T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:00:00Z", "date_only": false, "value": "2026-11-11T14:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.timeline.1.time", "text": "Made public."}, {"timestamp": "2026-11-11T15:02:31.341Z", "date_only": false, "value": "2026-11-11T15:02:31.341Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-123710", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T15:17:18Z", "date_only": false, "value": "2026-11-11T15:17:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JW94-V4WP-236W", "record": "GHSA-JW94-V4WP-236W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-11T15:17:18.340Z", "date_only": false, "value": "2026-11-11T15:17:18.340", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123710", "record": "FKIE_CVE-2026-123710", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T15:31:04Z", "date_only": false, "value": "2026-11-11T15:31:04Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JW94-V4WP-236W", "record": "GHSA-JW94-V4WP-236W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T15:40:06.037Z", "date_only": false, "value": "2026-11-11T15:40:06.037228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n22c34bdlw2k", "record": "CVE-2026-123710", "field": "creation_timestamp", "uuid": "64ef76a5-d3b0-4c09-afb4-05e22293aac3", "content": "CVE-2026-123710 - red hat quay 3\nRed Hat Quay versions 3 and 5 let anyone without authentication obtain a special token and use it to install their own signing key that never expires. That key allows the attacker to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#redhat #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n22c34bdlw2k"}, {"timestamp": "2026-11-11T16:07:30.079Z", "date_only": false, "value": "2026-11-11T16:07:30.079832Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3n22dm63wg22a", "record": "CVE-2026-123710", "field": "creation_timestamp", "uuid": "f8511d5d-86d2-44bd-beea-08fa95629874", "content": "\ud83d\udea8 CVE-2026-123710 \u2014 CVSS 9.8 CRITICAL\n\nA flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-123710\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3n22dm63wg22a"}, {"timestamp": "2026-11-11T18:07:22.996Z", "date_only": false, "value": "2026-11-11T18:07:22.996482Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117599138117406270", "record": "CVE-2026-123710", "field": "creation_timestamp", "uuid": "2ccb798e-54c8-4214-b6b7-08ae061bf5cf", "content": "CVE-2026-123710 Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.\nhttps://www.cve.org/CVERecord?id=CVE-2026-123710https://access.redhat.com/security/cve/CVE-2026-123710https://bugzilla.redhat.com/show_bug.cgi?id=2568072#RedHat #RedHatQuay3 #RedHatQuay5#CVE_2026_123710#bot", "url": "https://infosec.exchange/users/cve/statuses/117599138117406270"}, {"timestamp": "2026-11-12T00:45:03.774Z", "date_only": false, "value": "2026-11-12T00:45:03.774172Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n264unaocxdf", "record": "cve-2026-123710", "field": "creation_timestamp", "uuid": "51c87edb-b8a2-476c-96fc-d84f2d80930b", "content": "Developing: Critical Quay Vulnerability (CVE-2026-123710)\nhttps://cyber.eventmonitor.net/incident/EM-20261111-1357/critical-quay-vulnerability-cve-2026-123710/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n264unaocxdf"}, {"timestamp": "2026-11-12T12:10:10.017Z", "date_only": false, "value": "2026-11-12T12:10:10.017567Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chuiho.net/post/3n24gspoenp2u", "record": "cve-2026-123710", "field": "creation_timestamp", "uuid": "643928e9-63ed-4f97-b0d4-f3ca8888f1af", "content": "\uff3b\u6ce8\u610f\uff3dRed Hat Quay \u306e\u91cd\u5927\u6b20\u9665 CVE-2026-123710\u3001\u975e\u516c\u958b\u30a4\u30e1\u30fc\u30b8\u306b\u5371\u967a\n\u30b3\u30f3\u30c6\u30ca\u30fb\u30ec\u30b8\u30b9\u30c8\u30ea Red Hat Quay \u306e\u7f72\u540d\u9375\u306e\u7ba1\u7406\u306b\u91cd\u5927\u306a\u6b20\u9665\uff08CVE-2026-123710\u3001CVSS 9.8\uff09\u3002\u975e\u516c\u958b\u30a4\u30e1\u30fc\u30b8\u306e\u95b2\u89a7\u3084\u4e0a\u66f8\u304d\u306e\u304a\u305d\u308c\u3002\u4fee\u6b63\u7248\u306f\u672a\u516c\u8868\u3067\u3001\u66ab\u5b9a\u5bfe\u7b56\u3042\u308a\u3002\nhttps://chuiho.net/posts/red-hat-quay-cve-2026-123710-key-takeover/ #RedHatQuay #\u30b3\u30f3\u30c6\u30ca\u30ec\u30b8\u30b9\u30c8\u30ea", "url": "https://bsky.app/profile/chuiho.net/post/3n24gspoenp2u"}, {"timestamp": "2026-11-12T12:57:07.577Z", "date_only": false, "value": "2026-11-12T12:57:07.577541Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wojak7537.bsky.social/post/3n24jgofbd32t", "record": "CVE-2026-123710", "field": "creation_timestamp", "uuid": "d90941f9-169d-491d-84cf-96a207f1fc40", "content": "Red Hat Quay's CVE-2026-123710, CVSS 9.8, lets unauthenticated attackers take over registry token signing and read or overwrite any repository's images; no fixed version is identified.\nhttps://agxsearch.ai/t/lwgzjk?utm_source=bluesky&utm_medium=social", "url": "https://bsky.app/profile/wojak7537.bsky.social/post/3n24jgofbd32t"}, {"timestamp": "2026-11-12T13:23:15.408Z", "date_only": false, "value": "2026-11-12T13:23:15.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-123710", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T13:23:15.408Z", "date_only": false, "value": "2026-11-12T13:23:15.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:17:26.927Z", "date_only": false, "value": "2026-11-12T14:17:26.927", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123710", "record": "FKIE_CVE-2026-123710", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T15:31:52Z", "date_only": false, "value": "2026-11-12T15:31:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JW94-V4WP-236W", "record": "GHSA-JW94-V4WP-236W", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T17:46:40.055Z", "date_only": false, "value": "2026-11-12T17:46:40.055450Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117604718966752313", "record": "CVE-2026-123710", "field": "creation_timestamp", "uuid": "d83fa393-873a-416b-8625-4ea105f4b75f", "content": "This was updated yesterday:\nRed Hat Bugzilla: Bug 2568072 (CVE-2026-123710) - CVE-2026-123710 quay: Red Hat Quay: unauthenticated registry signing-key takeover via service key rotation https://bugzilla.redhat.com/show_bug.cgi?id=2568072\nMore:\nThe Hacker News: Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html @thehackernews #infosec #vulnerability #RedHatQuay #RedHat", "url": "https://infosec.exchange/users/AAKL/statuses/117604718966752313"}], "metrics": {"as_of": "2026-11-12T22:59:28.345Z", "anchors": {"origin": {"timestamp": "2026-11-11T14:00:00Z", "date_only": false, "value": "2026-11-11T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T14:00:00Z", "date_only": false, "value": "2026-11-11T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 118768.345128, "hours": 32.99120698, "days": 1.3746336241666666, "min_seconds": 118768.345128, "max_seconds": 118768.345128, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T14:00:00Z", "date_only": false, "value": "2026-11-11T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-123710", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T22:59:28.345Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}