CVE-2026-74247
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-918: Server-Side Request Forgery (SSRF)
Workarounds
To mitigate this issue, disable the FEATURE_BUILD_SUPPORT feature in Red Hat Quay if it is not essential for your operations. This action prevents the vulnerable build API endpoint from being exploited. Refer to the Red Hat Quay product documentation for detailed instructions on managing and disabling features.
References
- https://access.redhat.com/security/cve/CVE-2026-74247
- https://bugzilla.redhat.com/show_bug.cgi?id=2516144
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.