Riskcovery

CVE-2026-2377

Mirror-registry: quay: quay: server-side request forgery via log export functionality

State
Published
Severity
6.5 Medium
Published
Apr 8, 2026
Updated
Nov 1, 2026
Reserved
Feb 11, 2026

Read the record on cve.org

Description

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nredhat
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nredhat-SADP

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
Red Hat Quay 3.10Red Hat
  • 1779822261 and laterNot affected
Red Hat Quay 3.12Red Hat
  • 1779811412 and laterNot affected
Red Hat Quay 3.14Red Hat
  • 1779689392 and laterNot affected
Red Hat Quay 3.15Red Hat
  • 1780891395 and laterNot affected
Red Hat Quay 3.16Red Hat
  • 1779204086 and laterNot affected
Red Hat Quay 3.9Red Hat
  • 1779811473 and laterNot affected
mirror registry for Red Hat OpenShiftRed Hat
    mirror registry for Red Hat OpenShift 2Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.