A flaw in the notification webhook feature of Red Hat Quay allows a repository administrator to supply arbitrary URLs without verifying that the target is external. The application then directs the Quay workers to POST to those URLs, giving the attacker the ability to reach internal network services or cloud metadata endpoints that should not be exposed.

Red Hat products affected are Red Hat OpenShift Update Service and Red Hat Quay 3. Versions are not specified in the data; any installation of Quay 3 that contains the notification webhook feature is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows that the probability of exploitation is very low at the time of this analysis. The vulnerability is not listed in CISA KEV. Exploitation requires repository administrator privileges and an ability for the Quay workers to reach the target; it can be used to read internal services or cloud metadata but does not provide remote code execution or full system compromise.