openshift-update-service/openshift-update-service-rhel8 vulnerabilities
CVEs whose affected-version data names the openshift-update-service/openshift-update-service-rhel8 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-74247Medium· 4.2Quay: ssrf via build archive_url in quay build api
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL,…
CVE-2026-74243Medium· 6.5Quay: unauthenticated secscan notification endpoint in quay when psk is unset
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the…
CVE-2026-74245Medium· 5.9Quay: unauthenticated exported logs download in quay
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plainte…
CVE-2026-74241Medium· 4.8Quay: ldap referral filter injection in quay external ldap authentication
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allow…
CVE-2026-16910Medium· 5.5Quay: ssrf in red hat quay notification webhooks (slack/generic)
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POS…