PT-2026-64254 · Red Hat · Red Hat Openshift Update Service+1

CVE-2026-16910 · Published 2026-07-24 · Updated 2026-07-24

Mitre

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-16910

Affected Products

Red Hat Openshift Update Service

Red Hat Quay 3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-16910 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-16910 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2506685 · Note