Vulnerability · Published Mar 12, 2026 · Assigned by redhat

CVE-2026-2376Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

Medium 4.9

In plain English

A medium-severity open redirect in mirror registry for Red Hat OpenShift from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.2%top 94.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	mirror registry for Red Hat OpenShift	see references
Red Hat	mirror registry for Red Hat OpenShift 2	see references
Red Hat	Red Hat Quay 3	see references
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-2376 vdb-entry, x_refsource_REDHAT
RHBZ#2439117 issue-tracking, x_refsource_REDHAT
https://github.com/quay/quay/pull/5074