CVE-2026-74247CWE-918ssrf

CVE-2026-74247

Medium · published August 15, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-15T03:16Z
Affected products (2)
ProductVersionsFixed in
redhat/openshift_update_serviceall versions—
redhat/quayall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-74247 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2516144 · [email protected]
EPSS history
Timeline
  • 14 AUG 22:43Z
    Quay: ssrf via build archive_url in quay build api
    cvelistv5