A flaw was found in Red Hat Quay's build API. The endpoints/api/build.py endpoint accepts an archive_url parameter with only an http/https scheme check and no SSRF validation. The URL is stored and passed to the builder fetch path, allowing a user with FEATURE_BUILD_SUPPORT enabled and repository write access to make the Quay builder issue requests to internal network addresses. This is a distinct code path from CVE-2026-16910 (webhook/Slack notification SSRF) with different privilege requirements and impact profile.