A flaw exists in Quay's config-tool LDAP and SMTP validation functions that allows an attacker with configuration‑editor privileges to cause the tool to make outbound connections to arbitrary endpoints without filtering the target IP or hostname. The lack of host or IP validation effectively creates a server‑side request forgery (SSRF) that can be leveraged to probe internal network services, disclose server addresses, and map the internal infrastructure. The vulnerability results in a moderate breach of confidentiality and network visibility but does not directly grant code execution.

The affected system is Red Hat Quay version 3. No additional specific version details are provided beyond the product identifier.

The CVSS score of 4.1 indicates a moderate risk. An attacker must already possess configuration‑editor rights, which typically implies elevated access within the environment. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. The most likely attack vector is an insider or compromised account with config‑editor privileges initiating a malicious or misconfigured LDAP/SMTP validation request to a crafted internal endpoint, enabling internal network reconnaissance from the Quay pod's network position.