CVE-2026-85471
Received Received - Intake

Quay Repository SSRF via Hostname Blacklist Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: redhat-SADP

Description
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85471
EUVD
EUVD-2026-97776

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Red Hat mirror registry for Red Hat OpenShift *
Red Hat mirror registry for Red Hat OpenShift 2 *
Red Hat Red Hat Quay 3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85471 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay. An authenticated repository administrator can bypass the hostname blacklist in webhook notifications, allowing the Quay application to send HTTP POST requests to internal network resources like cloud metadata services or cluster services. This could lead to disclosure of sensitive information from these internal services.

Detection Guidance

To detect this vulnerability, monitor Quay webhook logs for POST requests to internal addresses like 169.254.169.254, 127.0.0.0/8, or RFC1918 ranges. Check for encoded IPs (decimal/octal) or alternative localhost representations in webhook URLs.

Impact Analysis

An attacker with repository admin privileges could exploit this to trick Quay into sending requests to internal services. This may expose sensitive data from those services through logged error responses. The impact is limited to HTTP POST requests and information leakage via logs.

Compliance Impact

This vulnerability could lead to unauthorized access to internal services and disclosure of sensitive data, which may violate compliance requirements like GDPR (data protection) or HIPAA (health information privacy). Exposed metadata or internal service data could contain regulated information.

Mitigation Strategies

Apply the official patch from Red Hat that routes webhook validation through the SSRF protection utility (util/security/ssrf.py). Temporarily disable webhook notifications if patches are unavailable. Restrict repository administrator privileges to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart