---
id: CVE-2026-2376
title: >-
  Mirror-registry: quay: quay: server-side request forgery via open redirect
  vulnerability in web interface
summary: >-
  A flaw was found in mirror-registry where an authenticated user can trick the
  system into accessing unintended internal or restricted systems by providing
  malicious web addresses. 


  When the application processes these addresses, it auto…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-601
vendor: Red Hat
product: openshift/mirror-registry-rhel8
affected:
  - openshift/mirror-registry-rhel8 (all versions)
  - openshift/mirror-registry-rhel8 (all versions)
  - quay/quay-rhel8 (all versions)
  - quay/quay-rhel9 (all versions)
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-12T20:43:37.225380Z'
exploitAvailable: true
published: '2026-03-12'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T05:06:40.224Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-2376'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-2376'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2439117'
    label: RHBZ#2439117
  - url: 'https://github.com/quay/quay/pull/5074'
tags:
  - cve.org
  - exploit-available
epss: 0.00166
epssPercentile: 0.05892
ingestedAt: '2026-11-05T18:28:50.687Z'
---

## Overview

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. 

When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

## Affected

- `openshift/mirror-registry-rhel8 (all versions)`
- `openshift/mirror-registry-rhel8 (all versions)`
- `quay/quay-rhel8 (all versions)`
- `quay/quay-rhel9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.