AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-16910

Red Hat Quay: server-side request forgery

Red Hat

CVE-2026-16910 · Published Jul 24, 2026

Medium5.5
No fix yet
Red Hat advisory

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Affected versions

PackageAffectedFixed in
Red Hat OpenShift Update Service
Product
all versionsNo fix yet
Red Hat Quay 3
Product
all versionsNo fix yet
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More Red Hat advisories

All Red Hat
Medium 5.4Jul 24Red Hat libsoup: request smugglingCVE-2026-66338no fix yetMedium 6.5Jul 24Red Hat libsoup: information disclosureCVE-2026-66339no fix yetMedium 6.5Jul 24Red Hat libsoup. An unsigned integer underflow: integer overflowCVE-2026-66337no fix yetHigh 8.5Jul 24A flaw was found in the cluster-proxy service-proxy component used in Red Hat...CVE-2026-17107no fix yetLow 3.1Jul 24Red Hat pki-core: improper authorizationCVE-2026-17039no fix yetMedium 6.5Jul 24Red Hat role-users endpoint: insecure direct object referenceCVE-2026-17059no fix yet