Executive brief
Red Hat Quay, a container image registry, contains a flaw in its configuration tool. An authorized administrator could use the LDAP and SMTP setup features to force the application to scan or connect to other systems on the internal network. This could allow an attacker to map out private infrastructure that is otherwise hidden from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Quay config-tool's LDAP and SMTP validation functions within 'pkg/lib/shared/validators.go'. The 'ValidateEmailServer' and 'ValidateLDAPServer' functions utilize 'net.DialTimeout' and 'ldap.DialURL' respectively on user-supplied endpoints without proper IP or host filtering. An attacker with configuration editor access (typically protected by HTTP Basic Auth in versions <= 3.16) can provide malicious URIs to probe internal network services from the Quay pod's network perspective. The LDAP validator also supports the 'ldapi://' scheme and may leak information through reflected LDAP result codes. While the web-based config editor was removed in version 3.17, the underlying vulnerability may still be reachable via CLI or container startup configurations.
Affected products
- Red Hat Quay config-tool <= 3.16
Timeline
- 2026-05-29: disclosed: Vulnerability reported and published to NVD