CVE-2026-74247

MediumCVSS 4.2

Published: 14/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

In Red Hat Quay, a user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit an SSRF vulnerability within the build API by providing a malicious URL, causing the builder to make requests to internal network addresses.

Risk Assessment

This could lead to disclosure of sensitive internal information, such as infrastructure details.

Recommendation

Restrict access to the build API and ensure FEATURE_BUILD_SUPPORT is disabled if not essential.

Original NVD description (English source)

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.