Bug 2439117 (CVE-2026-2376)

Summary: CVE-2026-2376 mirror-registry: quay: quay: Server-side Request Forgery via open redirect vulnerability in web interface
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bdettelb, doconnor, security-response-team, teagle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-11 20:33:13 UTC
An open redirect vulnerability was identified that allows user-controlled URLs to be supplied to backend workflows without sufficient validation. When combined with the log export callback functionality, this results in a server-side request forgery (SSRF) condition in which a backend worker performs HTTP requests to arbitrary destinations supplied by an authenticated user.