EUVD-2026-20507
GHSA-2c4x-699h-vw5x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a medium-severity risk with balanced exploitation and impact signals. The CVSS score of 6.5 is driven by high confidentiality impact (C:H) but restricted by authentication requirement (PR:L), a relatively low attack complexity (AC:L), and network accessibility (AV:N). The authentication gate is significant-only logged-in users can trigger the SSRF-which substantially reduces real-world attack surface compared to unauthenticated remote code execution vulnerabilities. However, the high confidentiality impact is concerning because SSRF can be chained to access internal metadata services (e.g., Kubernetes secrets, cloud provider credentials), internal APIs, or adjacent microservices not exposed to the internet. The lack of active exploitation data (no KEV or public POC identified) suggests this is not yet weaponized in campaigns, reducing immediate threat priority. In SSVC terms, this is a 'controlled' exploitation case requiring authentication, with significant but limited technical impact (confidentiality only, no code execution or availability loss). Organizations with strict network segmentation and minimal internal service exposure face lower real-world risk; those with permissive internal networks or sensitive metadata accessible via HTTP should prioritize remediation. |
| Exploit ScenarioDerived | A malicious insider with legitimate credentials to a Quay 3.x or Mirror Registry deployment crafts a log export request containing a URL parameter pointing to an internal Kubernetes API service or cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS). The application's backend processes the URL without validation and makes an HTTP request to that internal service, returning sensitive data (API tokens, cloud credentials) in the log export response, which the attacker then exfiltrates. This attack requires authentication but does not require social engineering or complex exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct arbitrary requests to internal network resources via a specially crafted URL in the log export feature, potentially exposing sensitive information and compromising internal systems. CVSS 6.5 (medium severity) with confirmed authentication requirement and high confidentiality impact. No active exploitation or public exploit code identified at time of analysis.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-2377 for the specific patched versions available for Mirror Registry and Quay 3.x; apply the recommended patch or upgrade immediately. As an interim control pending patch deployment, restrict access to the log export feature to only trusted administrative users and implement network-level controls (firewall rules, egress filtering) to prevent the affected application backends from reaching sensitive internal services or metadata endpoints. Additionally, audit audit logs for suspicious log export requests with unusual URL parameters targeting internal IP ranges or localhost.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exploits improper input validation in the log export functionality of Red Hat Mirror Registry and Red Hat Quay. When an authenticated user provides a maliciously crafted URL parameter to the log export feature, the application's backend processes the request without sufficient server-side validation, allowing the backend to make HTTP requests to attacker-specified destinations. This is a classic Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918 (Server-Side Request Forgery), where the application acts as an unwitting proxy for the attacker. The affected products are Red Hat Mirror Registry for Red Hat OpenShift (all versions), Mirror Registry for Red Hat OpenShift 2.x, and Red Hat Quay 3.x, as identified by multiple CPE strings in the inventory.
Know when Mirror Registry For Red Hat Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deser
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concur
Server-side request forgery in Red Hat Quay allows an authenticated repository administrator to bypass the hostname blac
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization adminis
OpenShift Mirror Registry leaks valid usernames and email addresses through inconsistent error messages during authentic
Exploit-DB