Vulnerability Description
Rejected reason: Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/claircore: the authentication mechanism in question (optional PSK, HTTP endpoint /indexer/api/v1/index_report) is implemented entirely in github.com/quay/clair; no PSK-related code exists anywhere in claircore's codebase or git history. The unauthenticated indexer API is Clair's documented, intentional design, authentication is an opt-in deployment choice, not a code defect. No fix commit was found in claircore between the version recorded as the affected boundary (1.5.52) and the following release (1.5.53); intervening commits are unrelated dependency and feature changes, so the "fixed in 1.5.52" status is inaccurate.
FAQ
What is CVE-2026-10517?
CVE-2026-10517 is a documented vulnerability. Rejected reason: Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/...
How severe is CVE-2026-10517?
CVSS scoring is not yet available for CVE-2026-10517. Check NVD for updates.
Is there a patch for CVE-2026-10517?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.