A flaw was found in Red Hat Quay's notification webhook dispatch feature. The SlackMethod and WebhookMethod notification handlers in notifications/notificationmethod.py accept attacker-controlled URLs without applying the validate_external_registry_url() SSRF validator that protects other Quay features (proxy cache, organization mirror, repository mirror). A repository administrator can create a notification whose delivery URL points to internal network addresses. When the notification fires, the Quay worker performs a POST request to the attacker-specified URL, enabling blind SSRF from the worker network context. The WebhookMethod includes a HOSTNAME_BLACKLIST check, but it only performs exact-hostname matching against a minimal default list (localhost, 127.0.0.1) and is trivially bypassed with private IP literals, cloud metadata hostnames, or DNS rebinding.