6.5
CVE-2026-2377
- EPSS 0.04%
- Veröffentlicht 08.04.2026 16:26:07
- Zuletzt bearbeitet 21.04.2026 17:59:53
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
Mirror-registry: quay: quay: server-side request forgery via log export functionality
A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Mirror Registry For Red Hat Openshift Version-
Redhat ≫ Mirror Registry For Red Hat Openshift Version2.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.11 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| secalert@redhat.com | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-918 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.