CVE-2026-2376

Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

Published Mar 12, 2026 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.

When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

Analysis

Technical impact

This vulnerability allows an authenticated user to supply arbitrary URLs to the mirror‑registry service. During processing the service follows redirects without validating the ultimate destination, enabling the attacker to force the system to reach internal or otherwise restricted resources. This can lead to unauthorized data exposure or other exploitation of internal systems.

Affected Systems

Affected products are Red Hat Quay 3 and the mirror registry for Red Hat OpenShift (versions 1 and 2). All instances of these components that have not been updated to the patched release are vulnerable.

Risk and Exploitability

The CVSS score of 4.9 indicates modest severity, and the EPSS score is below 1%, implying a low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog. Exploitation requires a user who can authenticate to the affected application and supply a crafted redirect URL; the application then forwards the request to internal hosts. There are no external dependencies beyond legitimate authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	mirror registry for Red Hat OpenShift	affected	—
Red Hat	mirror registry for Red Hat OpenShift 2	affected	—
Red Hat	Red Hat Quay 3	affected	—
Red Hat	Red Hat Quay 3	affected	—

Configuration 1 [-]

AND

cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:redhat:mirror_registry:-:*:*:*:*:openshift:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Mirror-registry

Quay

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Red Hat Quay 3 and the mirror registry for Red Hat OpenShift to versions that contain the fix for the SSRF issue.
If an upgrade cannot be performed immediately, disable or restrict the internal usage of redirect URLs by configuring the application to reject redirects to external or unknown hosts.
Apply network segmentation or firewall rules to block outbound traffic from the mirror‑registry service to internal addresses that are not intended to be reachable.

Generated by OpenCVE AI on April 16, 2026 at 02:46 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.186% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-2376
https://bugzilla.redhat.com/show_bug.cgi?id=2439117
https://github.com/quay/quay/pull/5074
https://nvd.nist.gov/vuln/detail/CVE-2026-2376
https://www.cve.org/CVERecord?id=CVE-2026-2376

History

Jun 2, 2026 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat enterprise Linux
CPEs		cpe:2.3:a:redhat:mirror_registry:-:::::openshift:: cpe:2.3:a:redhat:quay:3.0.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
Vendors & Products		Redhat enterprise Linux

Mar 12, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 12, 2026 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/quay/quay/pull/5074

Mar 12, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description	No description is available for this CVE.	A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Title	mirror-registry: quay: quay: Server-side Request Forgery via open redirect vulnerability in web interface	Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
First Time appeared		Redhat Redhat mirror Registry Redhat quay
CPEs		cpe:/a:redhat:mirror_registry:1 cpe:/a:redhat:mirror_registry:2 cpe:/a:redhat:quay:3
Vendors & Products		Redhat Redhat mirror Registry Redhat quay
References		https://access.redhat.com/security/cve/CVE-2026-2376 https://bugzilla.redhat.com/show_bug.cgi?id=2439117

Mar 4, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mirror-registry Mirror-registry quay
Vendors & Products		Mirror-registry Mirror-registry quay

Mar 4, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		No description is available for this CVE.
Title		mirror-registry: quay: quay: Server-side Request Forgery via open redirect vulnerability in web interface
Weaknesses		CWE-601
References		https://nvd.nist.gov/vuln/detail/CVE-2026-2376 https://www.cve.org/CVERecord?id=CVE-2026-2376
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'}` threat_severity `Moderate`