5.5
Medium
CVE-2026-16910 A flaw was found in Red Hat Quay's notification webhook feature
Description
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Update Service | Versions not published | |
| Red Hat Quay 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2506685 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Update Service
The 15 CVEs of Red Hat OpenShift Update Service →
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-74247
A flaw was found in Red Hat Quay
4.2
Medium
CVE-2026-74245
A flaw was found in Red Hat Quay's exported logs feature
5.9
Medium
CVE-2026-74244
A flaw was found in Red Hat Quay's Stripe billing webhook handler
5.9
Medium