PT-2026-25048 · Red Hat · Red Hat Quay 3+2

Osidb Bzimport · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-2376

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mirror-registry (affected versions not specified)

Description An issue exists in mirror-registry where an authenticated user can manipulate the system into accessing unintended internal or restricted systems by supplying malicious web addresses. The application automatically follows redirects without validating the final destination when processing these addresses, enabling attackers to route requests to unauthorized systems. The flaw allows attackers to bypass access controls and potentially access sensitive resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-2376

Affected Products

Red Hat Quay 3

Mirror Registry For Red Hat Openshift

Mirror Registry For Red Hat Openshift 2

References · 6

• https://osv.dev/vulnerability/CVE-2026-2376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2376 · Security Note
• https://github.com/quay/quay/pull/5074 · Note
• https://twitter.com/CVEnew/status/2032230666973102400 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2439117 · Note
• https://access.redhat.com/security/cve/CVE-2026-2376 · Note