Vulnerability in Red Hat mirror registry for Red Hat OpenShift

[ Description ]Official description

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund12 Oct 2026WID-SEC-2026-3886

  Red Hat Quay: Multiple vulnerabilities Translated from German

  CVE-2026-109195CVE-2026-85471CVE-2026-109194

[ References ]References

• access.redhat.com/security/cve/CVE-2026-85471
• bugzilla.redhat.com/show_bug.cgi