CVE Feed

    Dashboard / CVE / CVE-2026-74247

    CVE-2026-74247

    A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

    Published:Aug 14, 2026
    Last Modified:Aug 20, 2026
    EPS:Aug 14, 2026
    EPSS Score:0.00131
    CVSS Score:4.2

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Update Service
    Vendor
    Redhat
    Product
    Quay
    Vendor
    Redhat
    Product
    Quay 3

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-74244 (CVSS 5.9) — A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticate…
    CVE-2026-74242 (CVSS 5.3) — A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notifica…
    CVE-2026-74243 (CVSS 6.5) — A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unaut…
    CVE-2026-74241 (CVSS 4.8) — A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handli…
    CVE-2026-74245 (CVSS 5.9) — A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID cou…
    CVE-2026-74240 (CVSS 5.4) — A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sig…
    CVE-2026-16910 (CVSS 5.5) — A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification ha…
    CVE-2025-57854 (CVSS 6.4) — A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High