Critical Red Hat Quay Registry Flaw Allows Unauthenticated Read and Overwrite of Private Container Images — Detection and Remediation Guide

---
title: Unauthenticated Write Operation Against Quay Registry API
id: 3f8a2b61-7c4d-4e59-a912-0b6d8e1f2a34
status: experimental
description: Detects HTTP write methods (PUT/POST/PATCH) against OCI registry v2 API paths where the authenticated identity is anonymous or absent, consistent with exploitation of the Red Hat Quay broken access control flaw allowing overwrite of private images.
references:
  - https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.supply_chain_compromise
  - attack.t1195.001
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/v2/'
  selection_write:
    cs-method:
      - 'PUT'
      - 'POST'
      - 'PATCH'
  selection_api_path:
    cs-uri-stem|contains:
      - '/manifests/'
      - '/blobs/uploads/'
  selection_anon:
    cs-username:
      - '-'
      - 'anonymous'
      - ''
  condition: selection_uri and selection_write and selection_api_path and selection_anon
falsepositives:
  - Misconfigured CI pipelines pushing without credentials (should be investigated regardless)
  - Health checks (typically GET only; low risk)
level: critical
---
title: Mass Repository Enumeration on Quay Registry
id: 91c4e7d2-5a38-4f60-b824-6d1a9c3e7f05
status: experimental
description: Detects reconnaissance behavior consistent with an attacker enumerating all repositories and tags in a Quay registry, a precursor to bulk image theft or overwrite via the disclosed access control flaw.
references:
  - https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html
  - https://attack.mitre.org/techniques/T1595/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: webserver
detection:
  selection_catalog:
    cs-uri-stem|contains:
      - '/v2/_catalog'
      - '/api/v1/repository'
      - '/tags/list'
  selection_anon:
    cs-username:
      - '-'
      - 'anonymous'
      - ''
  condition: selection_catalog and selection_anon
falsepositives:
  - Internal vulnerability scanners and registry inventory tooling (allowlist known scanner IPs)
level: high
---
title: Quay Config File Access by Non-System Process
id: 5d2b8f40-1e96-4a37-c215-8f3b7a9d6e18
status: experimental
description: Detects processes other than the Quay service stack reading the Quay config.yaml, which contains FEATURE_ANONYMOUS_ACCESS and secret_key material an attacker may target after gaining a foothold on the registry host.
references:
  - https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/quay-registry/config.yaml'
      - '/conf/stack/config.yaml'
      - 'quay-config/config.yaml'
  filter_known:
    Image|endswith:
      - '/python'
      - '/gunicorn'
      - '/podman'
      - '/conmon'
  condition: selection and not filter_known
falsepositives:
  - Administrators cat-ing config during troubleshooting
  - Configuration management agents (Ansible/Puppet) — allowlist
level: medium

// Hunt: Unauthenticated writes and enumeration against Quay registry API
let lookback = 7d;
let QuayEvents = union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has_any ("/v2/", "api/v1/repository")
    | extend RawLog = SyslogMessage),
    (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has_any ("/v2/", "api/v1/repository")
    | extend RawLog = strcat(RequestMethod, " ", RequestURL, " user=", coalesce(SourceUserName, "-"), " status=", tostring(Activity)));
QuayEvents
| extend IsWrite = RawLog has_any ("PUT", "POST", "PATCH")
              and RawLog has_any ("/manifests/", "/blobs/uploads/"),
         IsEnum  = RawLog has_any ("/v2/_catalog", "tags/list", "api/v1/repository"),
         IsAnon  = RawLog has_any ("user=-", "anonymous", "\"-\"")
| where (IsWrite and IsAnon) or (IsEnum and IsAnon)
| summarize EventCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            SampleLogs = make_list(RawLog, 5)
         by Computer, SourceIP = coalesce(column_ifexists("SourceIP", ""), column_ifexists("HostIP", "")), IsWrite, IsEnum
| order by EventCount desc;

-- Artifact: Quay Anonymous Access + Registry Write Triage
-- 1) Check whether anonymous access is enabled in Quay config
LET config = SELECT read_file(filename=path) AS ConfigText, path AS ConfigPath
FROM glob(globs=[
  '/etc/quay/config.yaml',
  '/opt/quay/config.yaml',
  '/quay-registry/conf/stack/config.yaml',
  '/**/quay-config/config.yaml'
], root='/')
WHERE ConfigText =~ 'FEATURE_ANONYMOUS_ACCESS'

SELECT ConfigPath,
       ConfigText =~ 'FEATURE_ANONYMOUS_ACCESS: true' OR
       ConfigText =~ 'FEATURE_ANONYMOUS_ACCESS: True' AS AnonymousAccessEnabled
FROM config

-- 2) Pull recent unauthenticated PUT/POST/PATCH against /v2/ from nginx access logs
UNION (
  SELECT parse_string_with_regex(string=line,
         regex='^(?P<src>\S+) \S+ (?P<user>\S+) \[(?P<ts>[^\]]+)\] "(?P<method>\S+) (?P<uri>\S+) [^"]*" (?P<status>\d+)') AS Parsed,
         path AS LogPath
  FROM glob(globs='/var/log/nginx/access*.log', root='/'),
       foreach(row={SELECT read_file(filename=path) AS content FROM scope()}, query={
         SELECT split(string=content, sep='\n') AS lines FROM scope()
       })
  WHERE Parsed.uri =~ '^/v2/'
    AND Parsed.method IN ('PUT', 'POST', 'PATCH')
    AND Parsed.user IN ('-', 'anonymous')
)

#!/usr/bin/env bash
# Quay critical authz flaw - exposure assessment and hardening script
set -euo pipefail

echo "=== [1] Identify running Quay version ==="
if command -v podman &>/dev/null; then
  podman ps --format '{{.Names}} {{.Image}}' | grep -i quay || echo "No quay container via podman"
elif command -v docker &>/dev/null; then
  docker ps --format '{{.Names}} {{.Image}}' | grep -i quay || echo "No quay container via docker"
fi
# Record the version tag - compare against the fixed builds listed in the Red Hat advisory

echo "=== [2] Check anonymous access setting ==="
CONFIG_PATHS=("/etc/quay/config.yaml" "/opt/quay/config.yaml" "/quay-registry/conf/stack/config.yaml")
for p in "${CONFIG_PATHS[@]}"; do
  if [[ -f "$p" ]]; then
    echo "Found config: $p"
    grep -i "FEATURE_ANONYMOUS_ACCESS" "$p" || echo "  FEATURE_ANONYMOUS_ACCESS not set (default = ENABLED on vulnerable builds)"
  fi
done

echo "=== [3] HARDEN: explicitly disable anonymous access until patched ==="
# Add or set in config.yaml:
#   FEATURE_ANONYMOUS_ACCESS: false
# Then restart Quay. On OpenShift: patch the config bundle secret and roll the Quay pods.

echo "=== [4] Audit: anonymous write attempts in access logs (last 10k lines) ==="
for log in /var/log/nginx/access*.log; do
  [[ -f "$log" ]] || continue
  echo "-- $log"
  tail -n 10000 "$log" | grep -E '"(PUT|POST|PATCH) /v2/' | grep -E '^\S+ \S+ - ' | tail -n 50
done

echo "=== [5] Audit: catalog / enumeration activity from external IPs ==="
for log in /var/log/nginx/access*.log; do
  [[ -f "$log" ]] || continue
  grep -E '(/v2/_catalog|/api/v1/repository|tags/list)' "$log" | awk '{print $1}' | sort | uniq -c | sort -rn | head -20
done

echo "=== [6] Export current image digests for integrity baseline ==="
# For each critical repo, record manifest digests NOW so you can detect silent overwrites:
#   skopeo inspect docker://<quay-host>/<org>/<repo>:<tag> --creds user:token | jq '.Digest'
# Compare against digests recorded before the disclosure window.

echo "=== [7] Network exposure check ==="
ss -tlnp | grep -E ':(443|8443|8080)\b' || echo "No registry listeners found on standard ports"
echo "Confirm Quay is NOT reachable from untrusted networks (load balancer / firewall review)."