CVE-2026-74247 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay's build API. An authenticated user with repository write access and the FEATURE_BUILD_SUPPORT feature enabled can supply a malicious URL causing the Quay builder to make requests to internal network resources. This may disclose sensitive internal information by bypassing network access controls. Exploitation requires the FEATURE_BUILD_SUPPORT feature to be enabled and appropriate repository permissions. The vulnerability is classified under CWE-918. The CVSS v3.1 base score is 4.2 with low confidentiality and integrity impact, high attack complexity, and low privileges required.

Successful exploitation allows an authenticated user with repository write access and FEATURE_BUILD_SUPPORT enabled to perform SSRF attacks via the build API. This can lead to unauthorized access to internal network resources and potential disclosure of sensitive internal information. The attack surface is limited due to the need for specific configuration and privileges. There is no indication of integrity or availability impact beyond the SSRF and information disclosure.

Red Hat advises disabling the FEATURE_BUILD_SUPPORT feature in Red Hat Quay if it is not essential. Disabling this feature prevents access to the vulnerable build API endpoint and mitigates the SSRF vulnerability. Refer to Red Hat Quay product documentation for instructions on managing and disabling features. No official patch or fix version is currently stated; patch status is not yet confirmed — check the Red Hat advisory for updates.