Description
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service | — | — |
| Red Hat | Red Hat Quay 3 | — | — |
References
- https://access.redhat.com/security/cve/CVE-2026-74247 vdb-entry
- RHBZ#2516144 issue-tracking