CVE-2026-2377 — MEDIUM (6.5)

Vulnerability Description

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Mirror Registry For Red Hat Openshift	-
Redhat	Quay	3.0.0

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2026-2377?

CVE-2026-2377 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend proces...

How severe is CVE-2026-2377?

CVE-2026-2377 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-2377?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Mirror Registry For Red Hat Openshift, Redhat Quay.