PT-2026-25048 · Red Hat · Red Hat Quay 3+4

Osidb Bzimport · CVE-2026-2376 · Publicado 2026-03-12 · Atualizado 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mirror-registry (affected versions not specified)

Description An issue exists in mirror-registry where an authenticated user can manipulate the system into accessing unintended internal or restricted systems by supplying malicious web addresses. The application automatically follows redirects without validating the final destination when processing these addresses, enabling attackers to route requests to unauthorized systems. The flaw allows attackers to bypass access controls and potentially access sensitive resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-2376

Produtos afetados

Red Hat Quay 3

Mirror Registry For Red Hat Openshift

Mirror Registry For Red Hat Openshift 2

Mirror-Registry

Quay

Referências · 7

• https://github.com/quay/quay/pull/5074 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-2376 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2026-2376 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032230666973102400 · Publicação no Twitter
• https://bugzilla.redhat.com/show_bug.cgi?id=2439117 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-2376 · Aviso do Fabricante
• https://t.me/cveNotify/165700 · Publicação no Telegram