CVE-2026-16910
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
56/100
Published: 2026-07-24
Modified: 2026-11-01
First seen: 2026-11-01
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Changed
C:
Low
I:
Low
A:
None
Description
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.
Weakness Classification (1)
References & Advisories (2)
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT