# CVE-2026-10052: Red Hat Quay SSRF in config-tool LDAP and SMTP validation

Source: https://junglewise.ai/threats/cve-2026-10052-red-hat-quay-ssrf-in-config-tool-ldap-and-smtp-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-10052 · Severity: medium · CVSS 4.1 · Published 2026-05-29

Red Hat Quay, a container image registry, contains a flaw in its configuration tool. An authorized administrator could use the LDAP and SMTP setup features to force the application to scan or connect to other systems on the internal network. This could allow an attacker to map out private infrastructure that is otherwise hidden from the public internet.

Technologies: [Red Hat Quay config-tool](https://junglewise.ai/threats/technologies/quay-3-12). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-10052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10052 being exploited in the wild.

**How severe is CVE-2026-10052?** Medium severity, with a CVSS score of 4.1, published 29 May 2026.

**Which products and versions are affected?** Red Hat Quay config-tool <= 3.16.

**Is there a fix for CVE-2026-10052?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10052 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10052?** Check whether you run Red Hat Quay config-tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Quay config-tool's LDAP and SMTP validation functions within 'pkg/lib/shared/validators.go'. The 'ValidateEmailServer' and 'ValidateLDAPServer' functions utilize 'net.DialTimeout' and 'ldap.DialURL' respectively on user-supplied endpoints without proper IP or host filtering. An attacker with configuration editor access (typically protected by HTTP Basic Auth in versions <= 3.16) can provide malicious URIs to probe internal network services from the Quay pod's network perspective. The LDAP validator also supports the 'ldapi://' scheme and may leak information through reflected LDAP result codes. While the web-based config editor was removed in version 3.17, the underlying vulnerability may still be reachable via CLI or container startup configurations.

## Affected products

- Red Hat Quay config-tool <= 3.16

## Timeline

- 2026-05-29: disclosed: Vulnerability reported and published to NVD

## References

- [https://access.redhat.com/security/cve/CVE-2026-10052](https://access.redhat.com/security/cve/CVE-2026-10052)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2483157](https://bugzilla.redhat.com/show_bug.cgi?id=2483157)

## Related threats

- [Red Hat Quay credential disclosure in GitLab OAuth validator](https://junglewise.ai/threats/cve-2026-10078-red-hat-quay-credential-disclosure-in-gitlab-oauth-validator)