Skip to content
OpenAdvisories
Medium · 4.2 CVE-2026-74247 EUVD-2026-58823GHSA-rg7f-fcx2-cjw3

Quay: ssrf via build archive_url in quay build api

Published Aug 14, 2026 · Updated Nov 1, 2026 · Assigned by redhat

Description

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift Update Service — —
Red Hat Red Hat Quay 3 — —

References