Red Hat Quay CVE-2026-16910

Exploitation requires the attacker to hold the repository administrator role within a Red Hat Quay 3 instance - this is a non-default, privileged organizational role, not anonymous or low-privilege access. The attacker must have access to the Quay web UI or API to create or modify notification webhook configurations on a repository they administer. The Slack or generic webhook notification feature must be enabled and usable by repository administrators (enabled by default in standard Quay deployments). Exploitation is further amplified - but not required - when Quay workers run in a cloud-hosted environment (AWS, GCP, Azure) where metadata endpoints are accessible, or in an OpenShift cluster where internal Kubernetes API services are reachable from the worker pod. Exploitation is limited by: PR:H authentication gate (repository admin required), absence of an unauthenticated path, and network-level egress controls that may already block internal-range destinations in hardened deployments.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) scores 5.5 (Medium), which is a reasonable representation. The high privilege requirement (PR:H - repository administrator) is the primary risk-limiting factor and correctly drives the score down from what a full SSRF might warrant. However, the Scope:Changed (S:C) metric correctly captures the cross-boundary nature: the vulnerable Quay worker contacts internal services that are otherwise outside the attacker's reach. In cloud-hosted or OpenShift-managed deployments, internal SSRF can be disproportionately impactful relative to the Medium CVSS score - access to IMDSv1 endpoints can yield cloud credentials, and internal Kubernetes API server endpoints may be reachable. No EPSS score was provided in the intelligence feed, and this vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. Real-world risk is elevated in cloud-native or OpenShift environments where Quay workers have broad internal network access, and reduced in isolated on-premises deployments with strict egress controls. The key gatekeeping control is repository administrator authentication: exploitation cannot proceed without that access level.

A repository administrator within an OpenShift-hosted Quay instance configures a 'generic webhook' notification URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ - the AWS IMDSv1 metadata endpoint. When the next repository event fires (e.g., a push), the Quay worker issues a POST request to that URL, and the response containing temporary cloud IAM credentials may be observable via error messages, logs, or a controlled external relay. The attacker then uses the exfiltrated credentials to escalate access within the cloud account.