Tip: running Quay? Block /keys at the proxy today and list your service keys
- Turning off anonymous access isn't enough; any account can exploit it.
- Removing a rogue key only sticks once /keys is blocked or the fix is deployed.
- If you find one, assume private images and the secrets baked into them were read, and check recent tag changes.
Sources: Red Hat solution 7149923: CVE-2026-123710 Identifying and remediating unauthorized signing keys in Red Hat Quay (updated Nov 11, 2026) · Red Hat Bugzilla 2568072 (CVE-2026-123710)