4.2
Medium
CVE-2026-74247 A flaw was found in Red Hat Quay
Description
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Update Service | Versions not published | |
| Red Hat Quay 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2516144 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Update Service
The 15 CVEs of Red Hat OpenShift Update Service →
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-74245
A flaw was found in Red Hat Quay's exported logs feature
5.9
Medium
CVE-2026-74244
A flaw was found in Red Hat Quay's Stripe billing webhook handler
5.9
Medium
CVE-2026-74243
A flaw was found in Red Hat Quay
6.5
Medium