CVE-2026-2377

medium

Published 2026-04-08 · Modified 2026-06-03

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.5

Description

A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality Red Hat statement Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`. Even in case of compromise, the blast radius is restricted to mirror-registry. It can not…

Description

mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality

Red Hat statement

Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`. Even in case of compromise, the blast radius is restricted to mirror-registry. It can not be escalated outside the core product. This vulnerability has been scored based on the lack of change of scope.

CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Quay 3.12	`quay/quay-rhel8:1779811412`	RHSA-2026:22629	2026-06-02T00:00:00Z
Red Hat Quay 3.14	`quay/quay-rhel8:1779689392`	RHSA-2026:21017	2026-05-26T00:00:00Z
Red Hat Quay 3.16	`quay/quay-rhel9:1779204086`	RHSA-2026:19375	2026-05-19T00:00:00Z

Package state

Product	Package	State
mirror registry for Red Hat OpenShift	`openshift/mirror-registry-rhel8`	Fix deferred
mirror registry for Red Hat OpenShift 2	`openshift/mirror-registry-rhel8`	Fix deferred

Apply commands

bash fix

Apply RHSA-2026:22629 for Red Hat Quay 3.12

yum update -y quay/quay-rhel8:1779811412
# or:
dnf upgrade -y quay/quay-rhel8:1779811412

Application impact

Vendor	Product	Versions
redhat	mirror_registry_for_red_hat_openshift	`-`
redhat	mirror_registry_for_red_hat_openshift	`2.0`
redhat	quay	`3.0.0`

References

CWEs

CWE-918

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.