CVE-2026-2376 — Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresse…
Published: 2026-03-12 · CVSS: 4.9 · CVSS 3.1
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7