{"id":"CVE-2026-2376","state":"PUBLISHED","title":"Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface","description":"A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. \n\nWhen the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.","publishedAt":"2026-03-12T19:11:16.569Z","updatedAt":"2026-03-12T20:46:18.921Z","severity":{"score":4.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat mirror registry for Red Hat OpenShift","Red Hat mirror registry for Red Hat OpenShift 2","Red Hat Red Hat Quay 3"],"affected":[{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:1"]},{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift 2","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:2"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:3"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:3"]}],"references":["https://access.redhat.com/security/cve/CVE-2026-2376","https://bugzilla.redhat.com/show_bug.cgi?id=2439117","https://github.com/quay/quay/pull/5074"],"weaknesses":["CWE-601"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2376.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2376","state":"PUBLISHED","datePublished":"2026-03-12T19:11:16.569Z","dateUpdated":"2026-03-12T20:46:18.921Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-02-11T20:57:36.825Z"},"containers":{"cna":{"title":"Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface","descriptions":[{"lang":"en","value":"A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. \n\nWhen the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to."}],"affected":[{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:1"]},{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift 2","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mirror_registry:2"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:3"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2376","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439117","name":"RHBZ#2439117","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/quay/quay/pull/5074"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","description":"URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-03-12T20:03:31.350Z"},"datePublic":"2026-03-03T19:28:15.377Z","x_redhatCweChain":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","timeline":[{"lang":"en","time":"2026-02-11T20:27:37.958Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-03T19:28:15.377Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Antony Di Scala, Luffy Zhang, and Michael Whale for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-12T20:43:37.225380Z","id":"CVE-2026-2376","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-12T20:46:18.921Z"}}]}}}