---
id: CVE-2026-74247
title: 'Quay: ssrf via build archive_url in quay build api'
summary: >-
  A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled
  and repository write access can exploit a Server-Side Request Forgery (SSRF)
  vulnerability within the build API. This allows the user to provide a
  malicious URL,…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Red Hat
product: openshift-update-service/openshift-update-service-rhel8
affected:
  - openshift-update-service/openshift-update-service-rhel8 (all versions)
  - quay/quay-rhel8 (all versions)
  - quay/quay-rhel9 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-17T15:51:19.152284Z'
published: '2026-08-14'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T05:03:09.611Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74247'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-74247'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2516144'
    label: RHBZ#2516144
tags:
  - cve.org
epss: 0.00245
epssPercentile: 0.15825
ingestedAt: '2026-11-05T18:28:50.686Z'
---

## Overview

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

## Affected

- `openshift-update-service/openshift-update-service-rhel8 (all versions)`
- `quay/quay-rhel8 (all versions)`
- `quay/quay-rhel9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, disable the `FEATURE_BUILD_SUPPORT` feature in Red Hat Quay if it is not essential for your operations. This action prevents the vulnerable build API endpoint from being exploited. Refer to the Red Hat Quay product documentation for detailed instructions on managing and disabling features.