CVE-2026-74247 in Quay
Summary
by MITRE • 08/15/2026
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within Red Hat Quay's build API functionality where users with specific permissions can exploit a server-side request forgery flaw that enables unauthorized access to internal network resources. The issue specifically affects systems where FEATURE_BUILD_SUPPORT is enabled and users possess repository write access, creating a dangerous attack surface that could be leveraged by malicious actors to bypass normal network security controls.
The technical implementation of this vulnerability stems from insufficient input validation within the build API's URL handling mechanism. When a user submits a malicious URL through the build process, the Quay builder component fails to properly sanitize or validate the provided URI before initiating outbound network requests. This allows attackers to craft URLs that target internal services or resources that would normally be inaccessible from external networks, effectively circumventing firewall and network segmentation controls that typically protect sensitive internal systems.
From an operational perspective, this vulnerability presents significant risk to organizations relying on Red Hat Quay for container image building and deployment processes. Attackers could potentially enumerate internal services, access sensitive configuration data, retrieve internal documentation, or even exploit vulnerable internal systems that are not directly exposed to the internet. The impact extends beyond simple information disclosure as it provides a potential foothold for further lateral movement within the network infrastructure.
The vulnerability aligns with CWE-918, which specifically addresses server-side request forgery issues where attackers can manipulate a server into making unintended requests to internal resources. This weakness falls under the broader category of insecure direct object references and can be mapped to ATT&CK technique T1071.004 for application layer protocol tunneling. Organizations should consider implementing network segmentation controls, restricting access to build APIs, and validating all URLs against allowlists before processing requests through the build system.
Mitigation strategies should include immediate implementation of URL validation mechanisms that prevent requests to internal IP ranges or hostnames, deployment of network firewalls that restrict outbound connections from the Quay builder components, and comprehensive access control reviews to ensure only trusted users possess repository write permissions. Additionally, organizations should consider implementing webhook-based build triggers rather than direct URL input methods, and establish monitoring systems to detect anomalous network requests originating from build processes. Regular security audits of build configurations and automated scanning tools should be deployed to identify similar vulnerabilities across the container orchestration environment.