CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

CVE-2026-16910 Quay: ssrf in red hat quay notification webhooks (slack/generic)

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

EUVD-2026-48503

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

CVE-2026-16910

CVE-2026-16910 describes an SSRF flaw in Red Hat Quay’s notification webhook handlers for Slack and generic webhooks. The handlers accept user-supplied URLs without SSRF validation, enabling a repository administrator to cause the Quay worker to issue POST requests to internal network addresses o...

CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

Important: Red Hat Security Advisory: Red Hat Quay 3.15.6

Red Hat Quay 3.15.6 is now available with bug fixes. Quay 3.15.6...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

CVE-2026-15927

CVE-2026-15927: Red Hat Quay repository-level mirror feature allows SSRF via external_reference in POST/PUT to endpoints/api/mirror.py, not applying the stricter validate_external_registry_url() used by organization-level mirrors. This enables a repository administrator to craft a hostname that m...

Important: Red Hat Security Advisory: Red Hat Quay 3.16.5

Red Hat Quay 3.16.5 is now available with bug fixes. Quay 3.16.5...

Important: Red Hat Security Advisory: Red Hat Quay 3.10.24

Red Hat Quay 3.10.24 is now available with bug fixes. Quay 3.10.24...

Important: Red Hat Security Advisory: Red Hat Quay 3.10.23

Red Hat Quay 3.10.23 is now available with bug fixes. Quay 3.10.23...

Important: Red Hat Security Advisory: Red Hat Quay 3.12.19

Red Hat Quay 3.12.19 is now available with bug fixes. Quay 3.12.19...

Important: Red Hat Security Advisory: Red Hat Quay 3.9.23

Red Hat Quay 3.9.23 is now available with bug fixes. Quay 3.9.23...

Important: Red Hat Security Advisory: Red Hat Quay 3.17.3

Red Hat Quay 3.17.3 is now available with bug fixes. Quay 3.17.3...

Red Hat Quay 跨站脚本漏洞

Red Hat Quay is a container image repository platform operated by the American company Red Hat. Red Hat Quay has a cross-site scripting vulnerability. This vulnerability stems from the lack of validation of MIME types at the filedrop endpoint. It may allow authenticated users with write permissio...

Important: Red Hat Security Advisory: Red Hat Quay 3.9.22

Red Hat Quay 3.9.22 is now available with bug fixes. Quay 3.9.22...

Important: Red Hat Security Advisory: Red Hat Quay 3.10.22

Red Hat Quay 3.10.22 is now available with bug fixes. Quay 3.10.22...

Important: Red Hat Security Advisory: Red Hat Quay 3.17.2

Red Hat Quay 3.17.2 is now available with bug fixes. Quay 3.17.2...

GHSA-698X-9W2P-7VVP Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints

A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured opt-in, not enforced by default, an unauthenticated attacker can submit a manifest with...