CVE-2026-10052 — Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints
A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections…
Published: 2026-05-29 · CVSS: 4.1 · CVSS 3.1
A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering. This allows the attacker to perform internal network reconnaissance from the Quay pod's network position, potentially mapping the internal network infrastructure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7