Medium severity · published Apr 8, 2026
CVE-2026-2377
Mirror-registry: quay: quay: server-side request forgery via log export functionality
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Quay 3.10 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Quay 3.12 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Quay 3.14 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Quay 3.15 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Quay 3.16 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Quay 3.9 · Red Hat
All versions, or not specified · source: vendor, CISA
MR
Mirror Registry For Red Hat Openshift · Redhat
2.0 · source: vendor, NVD, CISA
MR
mirror registry for Red Hat OpenShift 2 · Red Hat
All versions, or not specified · source: vendor, CISA
QU
Quay · Redhat
3.0.0 · source: NVD
Affected product
MR
mirror registry for Red Hat OpenShift
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2377
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19375
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21017
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:22629
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:22840
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:23361
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:24853
More from mirror registry for Red Hat OpenShift
8.8
CVE-2026-32590
Mirror-registry: remote code execution using pickle deserialization
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.5
CVE-2026-27137
Incorrect enforcement of email constraints in crypto/x509
7.4
CVE-2026-32589
Mirror-registry: quay: insecure direct object reference in blobupload
6.4
CVE-2026-85471
Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable
