CVE-2026-74246

A flaw was found in Red Hat Quay's custom build trigger handler. This vulnerability allows a user with organization repository administrative privileges and the FEATUREBUILDSUPPORT enabled to read arbitrary files on the build worker. This is possible due to insufficient validation of the build...

CVE-2026-74247

Red Hat Quay contains a Server-Side Request Forgery (SSRF) vulnerability in its build API , specifically through the archive_url parameter. A user with repository write access and the FEATURE_BUILD_SUPPORT feature enabled can supply a malicious URL, causing the Quay builder to issue requests to i...

CVE-2026-74247 Quay: ssrf via build archive_url in quay build api

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...