CVE-2026-74247

Published: Aug 14, 2026Modified: Aug 20, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

Affected (2)

Products: Redhat: Openshift Update Service, Quay

2 products

Openshift Update Service

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Update Service	All versions
Redhat Quay	Version 3.0.0

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://access.redhat.com/security/cve/CVE-2026-74247

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2516144

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.