A flaw in Clair’s fetcher allows outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without filtering the IP address or scheme. When a pre‑shared key (PSK) is not configured, an unauthenticated attacker can submit a manifest that targets internal services or cloud metadata endpoints. The response is reflective: non‑200 responses leak up to 256 bytes of the error body through CheckResponse error messages. The weakness is a classic Server Side Request Forgery (CWE‑918), giving an attacker the ability to probe internal network resources.

The vulnerability exists in Red Hat Quay 3 when it is deployed without PSK authentication. Operator‑managed Quay deployments typically enable PSK by default, which eliminates the unauthenticated attack vector. Unmanaged or custom Quay installations that do not enable PSK remain susceptible.

The CVSS score of 5.8 indicates a medium severity. EPSS data are not available, and the vulnerability is not listed in CISA KEV. Exploitation requires access to the Quay API to submit a crafted manifest, so while the vector is unprivileged, the attacker must have network reach to the Quay service. The reflective leakage provides a limited but consistent window for internal reconnaissance.