CVE-2026-16910 PUBLISHED

Quay: ssrf in red hat quay notification webhooks (slack/generic)

Assigner: redhat
Reserved: 24.07.2026 Published: 24.07.2026 Updated: 24.07.2026

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 5.5

Product Status

Vendor Red Hat
Product Red Hat OpenShift Update Service
Versions Default: affected
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: unknown
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: affected

Workarounds

Restrict network egress from Quay worker pods/containers using network policies or firewall rules to block outbound connections to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254). Limit repository creation and admin privileges to trusted users. Configure WEBHOOK_HOSTNAME_BLACKLIST in Quay config to include known internal hostnames and IP ranges.

Credits

  • Red Hat would like to thank Martin Brodeur for reporting this issue.

References

Problem Types

  • Server-Side Request Forgery (SSRF) CWE