Red Hat Quay CVE-2026-10052

Exploitation requires that the attacker hold config editor access to the Red Hat Quay 3 config-tool (PR:H per CVSS vector) - this is a non-default, elevated permission role within Quay. The LDAP or SMTP validation functions in the config-tool must be accessible, which is typical in any standard Quay 3 deployment using the config-tool component. Exploitation is limited by: (1) the high privilege requirement - only users explicitly granted config editor rights can exploit this; (2) confidentiality impact only (no write or denial-of-service capability); and (3) SSRF-derived reconnaissance is typically blind or semi-blind, requiring inference from connection timing or error messages rather than direct response data. No special non-default configuration beyond having the config-tool deployed is required beyond possessing the elevated role.

The CVSS base score of 4.1 (Medium) reflects a bounded but real risk profile. The attack vector is network (AV:N) with low complexity (AC:L), meaning no special network positioning is needed beyond authenticated access. However, PR:H (high privileges required) is the primary limiting factor - only users with config editor access can trigger this vulnerability, significantly reducing the attack surface to a small set of privileged internal users or compromised admin accounts. The scope change (S:C) elevates the risk beyond the 4.1 score suggests: the confidentiality impact extends to internal network hosts that the Quay pod can reach, not just Quay itself. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. There is no KEV listing and no confirmed POC, indicating no known widespread exploitation. The SSVC technical impact is partial (low C, no I or A), but the internal reconnaissance capability makes this meaningful in environments where Quay pods have broad internal network access.

An attacker who has obtained config editor credentials - whether through credential theft, insider access, or privilege escalation - navigates to the Quay config-tool interface and submits a crafted internal IP address (e.g., 10.0.0.1:6443 for a Kubernetes API server or 169.254.169.254 for cloud metadata) as the LDAP server or SMTP server endpoint, then triggers the connectivity test function. The Quay pod initiates a TCP connection to the specified internal host, and the success/failure response or timing data reveals whether that host and port are reachable, enabling systematic internal network mapping. No public POC has been identified, but the attack technique requires only standard HTTP interaction with the config-tool UI.