Critical Red Hat Quay flaw CVE-2026-123710 lets attackers take over registry signing keys

·2 views

Red Hat has disclosed CVE-2026-123710, a critical vulnerability in Red Hat Quay's service key server, scored 9.8 out of 10. According to Red Hat, an unauthenticated network client can obtain an anonymous token, use it to install its own trusted signing key, and then access private images or overwrite existing tags. The flaw affects Red Hat Quay 3 and 5, including standalone deployments, the Quay Operator on OpenShift, and the mirror registry for OpenShift. Upstream fixes were merged on 11 November 2026, and Red Hat has published patched builds for several Quay 3 branches. Coverage reviewed so far reports no known in-the-wild exploitation, though the situation is described as developing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Fixing GitHub Actions 'reusable workflow was not found' errors

This error means a uses: reference was correctly formatted but could not be resolved to a workflow file. GitHub checks the file path, the ref on the target repository, read access for the caller, and whether the file declares workflow_call, stopping at the first failure. Runs with this error end instantly with no jobs or logs, and the annotation shows a chain of references where the last entry is the one that failed. That failing reference is often inside a nested workflow the user did not write. Developers are advised to read the chain bottom-up and verify the path, ref, and access against the owning repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indonesia's Official Port List Gets Coordinates via New Open Port API

A developer converted Indonesia's National Port Master Plan (RIPN), an official scanned PDF annex under ministerial decree KP 432/2017, into structured data covering 1,082 ports. The dataset adds latitude and longitude for 468 ports, matched against OpenStreetMap, the NGA World Port Index and UN/LOCODE. Coordinates are included only when they pass verification checks, such as multiple independent sources agreeing within 5 km or an exact name match within the same province and regency, and no estimated positions are used. Many ports, mostly small local and ferry ports, still lack coordinates, though they remain in the dataset with their official names and hierarchy. The data is offered through the Port API on API Indonesia, with some recent regulatory amendments not yet applied.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

csperf Episode Explains the Tool's Limits Using Doctor and List-Backends Checks

A DEV Community article argues that performance tools which silently refuse questions can erode user trust in their measurements. It presents csperf as a measurement observatory rather than an all-answering performance oracle. The episode uses the doctor and list-backends commands to reveal what the tool can and cannot assess, so missing answers are not mistaken for failures. Doctor checks the compilers, libraries, and runtime support csperf depends on, while list-backends shows which capabilities can be probed. The author ran these diagnostics on an Ubuntu 22.04 workstation with an Intel i7-12700K.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blackridge Systems Uses Evidence Gates to Vet Open-Source Components for Reuse

Blackridge Systems is an open-source Python project by krapcys1-maker that helps developers assemble systems from existing libraries and services while keeping a verifiable record of why each part was chosen. Its workflow discovers candidate repositories on GitHub, enriches them with metadata and security scores, and applies license, maintenance, security, and adoption checks. Components advance through an evidence ladder and must pass manual review before a system is marked production-ready, rather than relying on star counts or green CI. The project describes autonomous research features as a roadmap, while the current release is a manually reviewed vertical slice.

0 comments Read more at DEV Community