A flaw in Quay permits an authenticated repository administrator to bypass the hostname blacklist on webhook notification URLs, creating a Server‑Side Request Forgery (SSRF). The attacker can cause the Quay service to send HTTP requests to internal network endpoints—including cloud metadata services or other cluster services—thus potentially revealing confidential information.

The vulnerability affects Red Hat Quay 3 and the Red Hat mirror registry for Red OpenShift (versions 1 and 2). No explicit sub‑release information is available, so all current installations of these products should be considered potentially vulnerable until a vendor patch is released.

The CVSS score of 6.4 denotes moderate severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. An attacker must possess repository‑administrator credentials; once authenticated they can configure a webhook to target any internal host. The resulting SSRF can read data from internal services but does not grant direct code execution on the Quay host.