EUVD-2026-58823
GHSA-rg7f-fcx2-cjw3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible build API, exploitable by any repository write-access holder with no user interaction; high confidentiality from internal data exfiltration, low integrity from SSRF-driven internal requests, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
5DescriptionNVD
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
AnalysisAI
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the FEATURE_BUILD_SUPPORT flag must be explicitly enabled in the Quay configuration - installations without this feature active are not vulnerable; and (2) the attacker must hold repository write access within the Quay instance, which constitutes authenticated low-privilege access (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a high-confidentiality-impact network vulnerability exploitable with low privileges and no user interaction, which is a genuine priority in environments where FEATURE_BUILD_SUPPORT is active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained repository write access - whether through a compromised developer credential or a malicious insider - submits a Quay build job with a crafted build context URL pointing to an internal metadata service (e.g., a cloud instance metadata endpoint or an internal API gateway). The Quay builder service fetches the URL and returns response content that the attacker can observe, exposing internal credentials, configuration data, or service responses. … |
| Remediation | The primary remediation is to apply the vendor-supplied patch from Red Hat once available; consult https://access.redhat.com/security/cve/CVE-2026-74247 for errata and exact fixed version details, as no specific patched release version is confirmed in currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users with repository write access in Quay and confirm their legitimacy; if build functionality is not critical to operations, disable FEATURE_BUILD_SUPPORT immediately to eliminate the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today