6.4
Moyenne
CVE-2026-85471 A flaw was found in Quay
Description
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| mirror registry for Red Hat OpenShift | Versions non publiées | |
| mirror registry for Red Hat OpenShift 2 | Versions non publiées | |
| Red Hat Quay 3 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2528221 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de mirror registry for Red Hat OpenShift
Les 20 CVE de mirror registry for Red Hat OpenShift →
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
Élevée
CVE-2026-32591
A flaw was found in Red Hat Quay's Proxy Cache configuration feature
5.2
Moyenne
CVE-2026-32590
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads
7.1
Élevée
CVE-2026-32589
A flaw was found in Red Hat Quay's container image upload process
7.4
Élevée