---
id: CVE-2026-85471
title: A flaw was found in Quay
summary: >-
  A flaw was found in Quay. An authenticated repository administrator could
  bypass the hostname blacklist in webhook notifications, leading to a
  Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay
  application to be trick…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
vendor: Red Hat
product: openshift/mirror-registry-rhel8
affected:
  - openshift/mirror-registry-rhel8 (all versions)
  - openshift/mirror-registry-rhel8 (all versions)
  - quay/quay-rhel8 (all versions)
  - quay/quay-rhel9 (all versions)
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:33:26.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85471'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85471'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528221'
    label: secalert@redhat.com
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.1104
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T15:31:51.258447Z'
ingestedAt: '2026-10-12T20:03:12.358Z'
---

## Overview

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.