← CVE Intelligence

CVE-2026-2377

Mirror-registry: quay: quay: server-side request forgery via log export functionality PUBLISHED

Description (CNA)

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Quay 3.10unaffected 1779822261 before *
Red Hat / Red Hat Quay 3.12unaffected 1779811412 before *
Red Hat / Red Hat Quay 3.14unaffected 1779689392 before *
Red Hat / Red Hat Quay 3.15unaffected 1780891395 before *
Red Hat / Red Hat Quay 3.16unaffected 1779204086 before *
Red Hat / Red Hat Quay 3.9unaffected 1779811473 before *
Red Hat / mirror registry for Red Hat OpenShiftaffected
Red Hat / mirror registry for Red Hat OpenShift 2affected

CWE

CWE-918

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.