Description

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-14T23:16:34.730Z",
  "pubdate": "2026-08-14T23:16:34.730Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified within Red Hat Quay. The flaw exists in the build API and allows authenticated users with repository write access and the FEATURE_BUILD_SUPPORT feature enabled to supply arbitrary malicious URLs to the system. Upon processing, this input forces the Quay builder component to initiate outbound HTTP or network requests toward internal network addresses and restricted resources.\nThe primary impact of this vulnerability is the potential disclosure of sensitive internal information that is otherwise inaccessible from external networks. Attackers can leverage the internal request capabilities of the Quay builder to probe internal infrastructure, access metadata services, or interact with backend microservices.\nThe risk implication is moderate to high depending on network segmentation and the sensitivity of internal assets reachable from the builder component. Exploitation requires authenticated access with repository write permissions and the specific activation of the FEATURE_BUILD_SUPPORT capability within the target environment.",
  "technicalDetails": "The vulnerability resides within the build API of Red Hat Quay, specifically in how the application handles user-supplied URLs during the build process execution when FEATURE_BUILD_SUPPORT is enabled. The root cause is insufficient input validation, sanitization, and lack of destination URL restriction within the builder component before initiating outbound network connections.\nTo exploit this vulnerability, an attacker must possess authenticated access to Red Hat Quay along with repository write permissions. Additionally, the FEATURE_BUILD_SUPPORT configuration must be active. The attack flow begins when the malicious user crafts a build request containing a specially formulated payload within the URL parameter, pointing to an internal network address or a sensitive loopback/metadata IP address instead of an external, legitimate source repository.\nWhen the build API processes the request, the vulnerable component fails to validate whether the target URL resolves to a public or private IP space. Consequently, the Quay builder acts as an intermediary, executing the request on behalf of the user and dispatching traffic directly to internal network resources. The payload behavior involves forcing the server-side application to query internal ports, services, or endpoints that are protected from direct external access.\nThe post-exploitation impact includes the potential retrieval of internal application responses, sensitive configuration data, or cloud metadata service information returned to the builder and potentially leaked back to the user or logged in build outputs. The vulnerability exhibits network exposure via the exposed API endpoints used for triggering builds, relying on the server's internal network reachability to pivot attacks against adjacent internal infrastructure."
}