Content Quality: Dense, well-structured News article on two Red Hat Quay CVEs. Facts are separated from the Herald's own reading (diff reading, tag checks, subtraction are all labelled as the Herald's). 1,149 words by the pipeline counter, inside the News range of 400-1200. Clear disagreement section. Two wording points are filed as clarifications (see concerns).
Source Verification: Read all 21 snapshots from sources/2026-11/<slug>/ (source-0 to source-20; all status 200, no archive fallbacks, suspicious_patterns null on every source, so no prompt-injection scanner flags to judge). Then re-verified live on 2026-11-14 16:42-16:45 UTC by independent routes. (0-1) CVE Services records (cveawg.mitre.org): both state PUBLISHED, assigner redhat, datePublic 2026-11-11T14:00:00Z, CNA cvssV3_1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), Red Hat severity rating Critical on both, credits 'Dave O'Connor (Red Hat)' on both, workarounds text matches every quotation in the article ('install its own approved signing key with no expiry' appears in the CVE-2026-123710 description; 'is not durable until a fixed build is deployed' and 'no other complete workaround' in the workarounds). CISA ADP entries: CVE-2026-123710 timestamp 2026-11-13T14:17:57Z Exploitation none, Automatable yes; CVE-2026-110697 timestamp 2026-11-12T16:00:41Z Exploitation none, Automatable no; both match the article. Live re-fetch: dateUpdated 2026-11-13T20:50:57Z / 20:50:43Z, unchanged. The CVE record's own CNA score is Red Hat's (the CNA), so there is no separate CNA/Red Hat difference. (2-4) Red Hat CVE page and security-data JSON: threat_severity Critical, cvss3 9.8 and 9.9 with the same vectors, statement quotes verbatim ('Deployments where /keys is reachable by untrusted clients are affected'; 'lets an authenticated attacker break tenant isolation in multi-tenant Quay deployments'; 'No elevated privileges or victim interaction are required'), eight affected_release entries with advisories, and package_state = exactly two entries on both CVEs: product_name 'mirror registry for Red Hat OpenShift 2' fix_state Affected and product_name 'Red Hat Quay 5' (cpe:/a:redhat:quay:5, package quay/quay-rhel9) fix_state Affected, no advisory. Wording 'Red Hat Quay 5' matches the data; re-fetched live now: identical. The Red Hat CVE page shows Red Hat 9.8, NVD N/A, cve.org 9.8. (5-6) Support solutions 7149923 (updated 2026-11-13T10:56Z) and 7149592 (updated 2026-11-11T17:06Z): 'Anonymous access is on by default, and with it on, an attacker doesn't need an account. Turning off anonymous access doesn't protect you, because any valid Quay account can still exploit the flaw.' and 'Resetting passwords or regenerating robot tokens does not revoke an unauthorized signing key' are verbatim; environment list names standalone Quay, Quay Operator on OpenShift, and mirror registry for Red Hat OpenShift; 7149592 lists '3 separate attack vectors' (list tokens, delete namespace deletes robot accounts, rename changes prefix) as the article says. (7-14) Eight RHSA errata: synopses Red Hat Quay 3.18.3 (99019), 3.9.28 (99021), 3.16.7 (99022), 3.15.9 (99023), 3.14.10 (99024), 3.10.28 (99025), 3.17.7 (99026), 3.12.24 (99027); all 'Security Advisory: Critical'; Issued 2026-11-11, Updated 2026-11-12 (no time zone), and every one of the eight lists both CVE-2026-123710 and CVE-2026-110697 (recounted by script: 8 of 8). The table in the article maps every branch to the right advisory. Branches 3.11 and 3.13 are not among them, so 'eight 3.x branches' is exact. Red Hat's CVE page JSON gives advisory release dates 2026-11-11T15:37:16Z to 15:46:22Z. (15) GitHub commit 094cfb0: authored/committed 2026-11-11T14:43:00-05:00 = 19:43 UTC (also via the GitHub API: 2026-11-11T19:43:00Z); title 'Fix CVE-2026-110697 and CVE-2026-123710 (#8056)'; diff re-read through the API: KEY_ROTATION_CLAIM = 'key_rotation' and _validate_rotation_claim compares it with the kid; put_service_key now aborts 400 when expiration is missing or not in the future; v2auth passes app.config SERVER_HOSTNAME instead of the requested audience; prefix_search replaces the LIKE pattern for robot lookups. (16-17-18) Upstream via the GitHub API (routes: releases list, tags list, contents API at each tag): releases v3.18.3 14:52:31Z, v3.17.7 14:55:55Z, v3.16.7 14:57:13Z, v3.14.10 15:44:39Z, v3.12.24 15:49:41Z, v3.10.28 15:51:27Z, v3.9.28 15:52:56Z (all 2026-11-13). KEY_ROTATION_CLAIM present in endpoints/keyserver/__init__.py at all seven of those tags and absent at v3.18.2, v3.17.6, v3.16.6, v3.14.9, v3.12.23, v3.10.27, v3.9.27 and v3.15.8. No v3.15.9 tag, release or ref exists (404 on tags, releases/tags and git/ref; tag list for 3.15 ends at v3.15.8) as of 2026-11-14 16:40 UTC. The seven release bodies contain neither CVE id (grep count 0). The tag naming and the Herald's own labelling are correct. (19) The Hacker News (Nov 12, Swati Khandelwal): says Red Hat released fixed builds for eight Quay 3 branches, 9.8 and 9.9, Dave O'Connor found both, 'When checked today, the CVE entry for CVE-2026-123710 still showed every Quay package as affected, with no fix, even though each advisory lists the flaw', and 'none of the eight advisories list CVE-2026-110697'. The article quotes the first and paraphrases the second correctly. What THN adds beyond Red Hat's own pages: the observation about the CVE page state on Nov 12, the remark that the vulnerable logic dates from Quay's first public commit (not used by the article), and a plain-language account; most of the rest relays Red Hat's statements, as the writer says. It is the one independent outlet. (20) CISA KEV: catalogVersion 2026.11.13, dateReleased 2026-11-13T20:24:18Z, 1,781 entries; neither CVE (nor any Quay entry) is listed; live re-fetch now returns the same version. Retried NVD (services.nvd.nist.gov, 2026-11-14 16:42-16:43 UTC): HTTP 200 now. CVE-2026-123710 status Analyzed and CVE-2026-110697 Awaiting Analysis, each with a single CVSS 3.1 metric whose source is [email protected] (type Secondary) carrying 9.8 and 9.9 with the same vectors, so NVD adds no independent NIST score; the article's statement that NVD returned 503 at 16:17 UTC and that no NVD score is reported is accurate for the time it was written and is not contradicted (sha256 of the two NVD responses begin 3c7a0e1b54b4 and fe862ab33a8f). Archive.org (route used to test the disagreement): capture of access.redhat.com/security/cve/cve-2026-123710 at 2026-11-12 16:58:05 UTC (fetched with the id_ raw flag, decompressed sha256 begins 65dff9716bef) lists 'Red Hat Quay 3' (quay/quay-rhel8 and quay/quay-rhel9) and 'Red Hat Quay 5' all in state Affected with empty advisory arrays and no Fixed entry, which matches THN's description; the Herald's later read shows eight per-branch Fixed entries. So the disagreement is a timing difference in Red Hat's page (changed after 2026-11-12 16:58 UTC), not a misreading by either side; filed as a clarification. The capture of the CVE-2026-110697 page (2026-11-12 17:03:25 UTC) and any capture of the errata pages could not be read (Archive.org returned 429, then 'Temporarily Offline'; no errata captures are indexed). Allowlist: all five hosts (access.redhat.com, cveawg.mitre.org, github.com, thehackernews.com, cisa.gov, which covers www.cisa.gov) are in config/source_allowlist.txt; no additions. Independence: one independent outlet (The Hacker News); GitHub and the Red Hat advisories are first-party Red Hat/Project Quay sources; CISA is a government data feed. This is a News article, so the Analysis requirements do not apply. Anthropic disclosure: not required - the subject is Red Hat Quay; neither the article nor the cited pages concern Anthropic or Claude (the only matches are a '.claude' directory and CLAUDE.md file name in the GitHub file-tree JSON of the repository and a sidebar link to an unrelated Hacker News story, both incidental). Human-requested: no.
Factual Accuracy: Headline: 'Fixes CVE-2026-123710 and CVE-2026-110697' (both ids exist in CVE Services, Red Hat pages and all eight RHSAs), 'Both Rated Critical by Red Hat' (threat_severity Critical on both; CNA CVSS 9.8 and 9.9; every advisory 'Critical'), 'in Eight 3.x Branches' (eight advisories, eight distinct branches 3.9, 3.10, 3.12, 3.14, 3.15, 3.16, 3.17, 3.18) and 'Red Hat Data Lists Quay 5 as Affected' (package_state fix_state Affected, product 'Red Hat Quay 5', no advisory, on both CVEs) are each supported. Summary and lead supported, including 'none of the cited sources reports exploitation' (checked all 21: no source reports in-the-wild exploitation; ADP says Exploitation none; KEV lists neither; the 'exploit' wording in Red Hat and THN is hypothetical). Credits: only Dave O'Connor (Red Hat), also in THN and the Red Hat data; 'None of the sources cited here names an outside reporter' holds. Quantifier and absence sentences tested against every snapshot (both, every, each, none, neither, nor, only): 'every one of the eight advisory pages' (8 of 8), 'each is the version in the title of one advisory' (yes), 'the seven release notes name neither CVE' (0 of 7), 'no v3.15.9' (confirmed), 'Neither identifier was in version 2026.11.13' (confirmed) all hold. Dates: 14:00 UTC (datePublic), 19:43 UTC = 14:43-05:00 (time zone basis stated), 14:52:31-15:52:56 UTC releases, ADP timestamps 14:17 and 16:00 UTC, KEV 20:24 UTC all match; 'two days after the advisories' issue date' (Nov 13 vs Nov 11) is correct arithmetic. Derived figures and quoted figures recomputed from raw lists. Vendor figures are labelled Red Hat's. Not an error but context for readers: Red Hat's CVE page gives advisory release times of 15:37-15:46 UTC on Nov 11, about four hours before the 19:43 UTC upstream fix commit; the article gives the two times separately without claiming an order.
Overall Assessment: Headline, summary and lead are each supported by raw text read from the CVE Services records, Red Hat's pages and security data, all eight errata and the GitHub API; the eight-advisory recount, both CVE ids on every advisory, the Quay 5 and mirror registry 2 Affected states, the 3.15.9 gap, the exploitation absence claims and the quoted passages all hold. Only two subordinate wording points need public clarification, so the article is published with a corrections record (two clarifications). Featured candidacy: 2 - critical, unauthenticated-capable registry key takeover and cross-tenant token theft in a widely deployed enterprise container registry, with patches out and a documented vendor-data discrepancy that operators need to weigh