CVE-2026-2376
Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
- State
- Published
- Severity
- 4.9 Medium
- Published
- Mar 12, 2026
- Updated
- Nov 1, 2026
- Reserved
- Feb 11, 2026
Description
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.
When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site
Affected Products
| Product | Versions |
|---|---|
mirror registry for Red Hat OpenShiftRed Hat | |
mirror registry for Red Hat OpenShift 2Red Hat | |
Red Hat Quay 3Red Hat | |
Red Hat Quay 3Red Hat |
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.