---
title: Tip: running Quay? Block /keys at the proxy today and list your service keys | ctxsec
url: https://ctxsec.com/items/tip-block-quay-keys-service-key-endpoint-at-proxy-until-cve-2026-123710-fix
description: "Until Red Hat ships a fixed Quay build for CVE-2026-123710, only trusted internal Quay components should reach the service key endpoints. Block /keys for everyone else at the load balancer or route, then review the approved service keys for anything you didn't create, especially keys with no expiry, and remove it."
status: "official guidance (Red Hat solution 7149923, Nov 11, 2026)"
published: 2026-11-12
---

> Until Red Hat ships a fixed Quay build for CVE-2026-123710, only trusted internal Quay components should reach the service key endpoints. Block /keys for everyone else at the load balancer or route, then review the approved service keys for anything you didn't create, especially keys with no expiry, and remove it.

[← Tips & Guides](/tips) · [markdown](/items/tip-block-quay-keys-service-key-endpoint-at-proxy-until-cve-2026-123710-fix.md)

official guidance (Red Hat solution 7149923, Nov 11, 2026)

2026-11-12 7:40 AM ET

### Tip: running Quay? Block /keys at the proxy today and list your service keys

- Turning off anonymous access isn't enough; any account can exploit it.
- Removing a rogue key only sticks once /keys is blocked or the fix is deployed.
- If you find one, assume private images and the secrets baked into them were read, and check recent tag changes.

Sources: [Red Hat solution 7149923: CVE-2026-123710 Identifying and remediating unauthorized signing keys in Red Hat Quay (updated Nov 11, 2026)](https://access.redhat.com/solutions/7149923) · [Red Hat Bugzilla 2568072 (CVE-2026-123710)](https://bugzilla.redhat.com/show_bug.cgi?id=2568072)