Vulnerability · Published Oct 12, 2026 · Assigned by redhat

CVE-2026-85471Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

Medium 6.4

In plain English

A medium-severity server-side request forgery in mirror registry for Red Hat OpenShift from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	mirror registry for Red Hat OpenShift	see references
Red Hat	mirror registry for Red Hat OpenShift 2	see references
Red Hat	Red Hat Quay 3	see references
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-85471 vdb-entry, x_refsource_REDHAT
RHBZ#2528221 issue-tracking, x_refsource_REDHAT