A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-2377) was identified in Red Hat Quay 3.10 and its mirror registry for Red Hat OpenShift. The flaw involves the log export feature, which permits an authenticated user to specify an arbitrary callback URL. The backend process performs HTTP requests to this URL, allowing potential SSRF attacks that could be used to access internal network resources and disclose sensitive information. The vulnerability carries a CVSS 3.1 base score of 6.5 with network attack vector, low attack complexity, and requires privileges but no user interaction. Red Hat has published security advisories and released fixed versions (e.g., Quay 3.14.8 and 3.16.4) that include patches addressing this vulnerability. The vendor advisory does not indicate any required immediate action beyond applying these updates. No exploits are currently known in the wild.

An attacker with authenticated access to the log export feature can cause the backend to make arbitrary HTTP requests to attacker-controlled URLs. This SSRF vulnerability could allow the attacker to access internal network resources that are otherwise inaccessible, potentially leading to disclosure of sensitive information. The CVSS score of 6.5 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact. There are no reports of active exploitation in the wild.

Red Hat has released fixed versions of Red Hat Quay, including 3.14.8 and 3.16.4, which address this SSRF vulnerability. Users should apply these updates after ensuring all previously released errata relevant to their systems have been applied. The vendor advisory does not indicate any alternative mitigations or that no action is required. Patch status is confirmed by the vendor advisories linked. No additional immediate mitigations are specified.