This vulnerability exists in the mirror registry for Red Hat OpenShift, where an authenticated user can abuse the log export feature by providing a specially crafted URL. This triggers the backend to perform arbitrary HTTP requests within the internal network, a classic SSRF scenario. The vulnerability could lead to unauthorized information disclosure from internal systems. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges but no user interaction, with high confidentiality impact and no integrity or availability impact.

Successful exploitation allows an authenticated user to cause the backend server to make arbitrary requests to internal network resources, potentially exposing sensitive information from internal systems. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-2377 for current remediation guidance. Since no official fix or temporary workaround is explicitly stated in the advisory content provided, users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the log export feature to trusted users and networks if possible.