EUVD-2026-48503
GHSA-6j6h-vfwh-mxgx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Repository admin access (PR:H) required to set webhook URLs; scope changes (S:C) because worker contacts internal services beyond application boundary.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.
AnalysisAI
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold the repository administrator role within a Red Hat Quay 3 instance - this is a non-default, privileged organizational role, not anonymous or low-privilege access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) scores 5.5 (Medium), which is a reasonable representation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A repository administrator within an OpenShift-hosted Quay instance configures a 'generic webhook' notification URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ - the AWS IMDSv1 metadata endpoint. When the next repository event fires (e.g., a push), the Quay worker issues a POST request to that URL, and the response containing temporary cloud IAM credentials may be observable via error messages, logs, or a controlled external relay. … |
| Remediation | Apply the vendor-supplied patch when released; monitor https://access.redhat.com/security/cve/CVE-2026-16910 for an updated advisory with a confirmed fixed version, as no exact patch version is confirmed from the currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today