5.5
Moyenne
CVE-2026-16910 A flaw was found in Red Hat Quay's notification webhook feature
Description
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Update Service | Versions non publiées | |
| Red Hat Quay 3 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2506685 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Update Service
Les 15 CVE de Red Hat OpenShift Update Service →
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
Élevée
CVE-2026-74247
A flaw was found in Red Hat Quay
4.2
Moyenne
CVE-2026-74245
A flaw was found in Red Hat Quay's exported logs feature
5.9
Moyenne
CVE-2026-74244
A flaw was found in Red Hat Quay's Stripe billing webhook handler
5.9
Moyenne