4.9
Medium
CVE-2026-2376 A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended…
Description
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mirror registry for Red Hat OpenShift | Versions not published | |
| mirror registry for Red Hat OpenShift 2 | Versions not published | |
| Red Hat Quay 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2439117 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of mirror registry for Red Hat OpenShift
The 20 CVEs of mirror registry for Red Hat OpenShift →
CVE-2026-85471
A flaw was found in Quay
6.4
Medium
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
High
CVE-2026-32591
A flaw was found in Red Hat Quay's Proxy Cache configuration feature
5.2
Medium
CVE-2026-32590
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads
7.1
High