Vulnerability · Published Jul 24, 2026 · Assigned by redhat

CVE-2026-16910Quay: ssrf in red hat quay notification webhooks (slack/generic)

Medium 5.5

In plain English

A medium-severity server-side request forgery in Red Hat OpenShift Update Service from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Update Service	see references
Red Hat	Red Hat Quay 3	see references
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-16910 vdb-entry, x_refsource_REDHAT
RHBZ#2506685 issue-tracking, x_refsource_REDHAT