6.4
Medium
CVE-2026-85471 A flaw was found in Quay
Description
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mirror registry for Red Hat OpenShift | Versions not published | |
| mirror registry for Red Hat OpenShift 2 | Versions not published | |
| Red Hat Quay 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2528221 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of mirror registry for Red Hat OpenShift
The 20 CVEs of mirror registry for Red Hat OpenShift →
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
High
CVE-2026-32591
A flaw was found in Red Hat Quay's Proxy Cache configuration feature
5.2
Medium
CVE-2026-32590
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads
7.1
High
CVE-2026-32589
A flaw was found in Red Hat Quay's container image upload process
7.4
High