Bug 2483157 (CVE-2026-10052) - CVE-2026-10052 quay/config-tool: quay/config-tool: SSRF via unfiltered LDAP and SMTP config validation endpoints
Summary: CVE-2026-10052 quay/config-tool: quay/config-tool: SSRF via unfiltered LDAP a...
Keywords:
Status: NEW
Alias: CVE-2026-10052
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-29 07:35 UTC by OSIDB Bzimport
Modified: 2026-05-29 07:52 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-29 07:35:17 UTC
The Quay config-tool's LDAP and SMTP validation functions in pkg/lib/shared/validators.go make outbound connections to user-supplied endpoints with no IP/host filtering. ValidateEmailServer calls net.DialTimeout to the configured mail server, and ValidateLDAPServer calls ldap.DialURL to the configured LDAP URI. An attacker with config editor access (HTTP Basic Auth on the config-tool editor, Quay <= 3.16) can exploit these to perform internal network reconnaissance from the Quay pod's network position. The config editor web application was removed in Quay 3.17, limiting the attack vector to CLI or container startup in newer versions. The LDAP validator also accepts the ldapi:// scheme and reflects LDAP result codes in error messages. The GitLab OAuth validator separately exposes client_secret in URL querystrings (CWE-598).


Note You need to log in before you can comment on or make changes to this bug.