What’s Vulnerable › Vulnerabilities

CVE-2026-85471: Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-11-01
• Weakness: CWE-918

Description

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

Affected products

• Red Hat mirror registry for Red Hat OpenShift: all versions
• Red Hat mirror registry for Red Hat OpenShift 2: all versions
• Red Hat Quay 3: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-85471
• https://bugzilla.redhat.com/show_bug.cgi?id=2528221

Get alerted when CVE-2026-85471 or the next vulnerability affects your stack