CVE Feed

    Dashboard / CVE / CVE-2026-16910

    CVE-2026-16910

    A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

    Published:Jul 7, 2026
    Last Modified:Aug 2, 2026
    EPS:Jul 24, 2026
    EPSS Score:0.00213
    CVSS Score:5.5

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Update Service
    Vendor
    Redhat
    Product
    Quay
    Vendor
    Redhat
    Product
    Quay 3

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-74247 (CVSS 4.2) — A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can ex…
    CVE-2026-74244 (CVSS 5.9) — A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticate…
    CVE-2026-74242 (CVSS 5.3) — A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notifica…
    CVE-2026-74243 (CVSS 6.5) — A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unaut…
    CVE-2026-74241 (CVSS 4.8) — A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handli…
    CVE-2026-74245 (CVSS 5.9) — A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID cou…
    CVE-2026-74240 (CVSS 5.4) — A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sig…
    CVE-2025-57854 (CVSS 6.4) — A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High