Skip to content
fr Sign in
6.5 Medium

CVE-2026-2377 A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift

Description

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.

Affected products and versions

Product Affected versions Fixed in
mirror registry for Red Hat OpenShift Versions not published
mirror registry for Red Hat OpenShift 2 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.14 1779689392 earliest → < 1779689392 1779689392
Red Hat Quay 3.12 1779811412 earliest → < 1779811412 1779811412
Red Hat Quay 3.1 1779822261 earliest → < 1779822261 1779822261
Red Hat Quay 3.9 1779811473 earliest → < 1779811473 1779811473
Red Hat Quay 3.15 1780891395 earliest → < 1780891395 1780891395
Show the other branch
Product Affected versions Fixed in
Red Hat Quay 3.10 1779822261 earliest → < 1779822261 1779822261

References

Timeline

  1. Published
  2. Last modified

Other CVEs of mirror registry for Red Hat OpenShift

The 20 CVEs of mirror registry for Red Hat OpenShift →
CVE-2026-85471 A flaw was found in Quay 6.4 Medium CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 High CVE-2026-32591 A flaw was found in Red Hat Quay's Proxy Cache configuration feature 5.2 Medium CVE-2026-32590 A flaw was found in Red Hat Quay's handling of resumable container image layer uploads 7.1 High
Track this CVE