PT-2026-64254 · Red Hat · Red Hat Openshift Update Service+1

CVE-2026-16910 · Publicado 2026-07-24 · Atualizado 2026-07-24

Mitre

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-16910

Produtos afetados

Red Hat Openshift Update Service

Red Hat Quay 3

Referências · 3

• https://access.redhat.com/security/cve/CVE-2026-16910 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2506685 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-16910 · Nota de Segurança