The vulnerability exists in the Proxy Cache configuration of Red Hat Quay 3.1, where the application does not validate the hostname of an upstream registry configured by an organization administrator. This lack of validation enables an attacker with organization administrator privileges to supply a crafted hostname, causing the Quay server to make network requests to internal or otherwise restricted resources. This is classified as CWE-918 (Server-Side Request Forgery). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with organization administrator privileges can exploit this vulnerability to make the Quay server send requests to internal network services or cloud infrastructure endpoints that are normally inaccessible. This can lead to unauthorized information disclosure (high confidentiality impact) but has limited impact on integrity and no impact on availability. There are no known exploits in the wild at this time.

Red Hat has released updated versions of Red Hat Quay that address this vulnerability, specifically version 3.17.3 and 3.9.24 as per the Red Hat advisories RHSA-2026:24833 and RHSA-2026:40262. Users should apply these updates after ensuring all previous errata are applied. No temporary or alternative mitigations are specified in the vendor advisories. Patch status is confirmed by Red Hat advisories; therefore, applying the official updates is the recommended remediation.