CVE-2026-2376

MEDIUM EPSS 5.2%
Published Mar 12, 20263mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Mar 12, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
5.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-601

Affected Products 5

VendorProductVersionRange
redhatquay3.0.0any
redhatenterprise_linux8.0any
redhatenterprise_linux9.0any
redhatmirror_registry*any
redhatenterprise_linux8.0any

References 3

  • access.redhat.com https://access.redhat.com/security/cve/CVE-2026-2376
    Vendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2439117
    Vendor Advisory
  • github.com https://github.com/quay/quay/pull/5074
    Issue TrackingPatch

Remediation

  • github.com https://github.com/quay/quay/pull/5074
    Issue TrackingPatch