Executive brief
Clair, a tool used for scanning container images for security vulnerabilities, contains a flaw that allows attackers to trick the system into making unauthorized network requests. If the software is not configured with specific security keys, an unauthenticated attacker can use this to probe internal corporate networks or access sensitive cloud metadata. This could lead to the exposure of internal service details or small amounts of sensitive configuration data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Claircore fetcher component. The component fails to perform IP or scheme filtering on attacker-supplied URIs within manifest layer descriptors. In deployments where Pre-Shared Key (PSK) authentication is not explicitly configured, an unauthenticated attacker can submit a manifest pointing to internal services or cloud metadata endpoints (e.g., 169.254.169.254). While full response exfiltration is prevented by digest validation, the vulnerability is reflective; the 'CheckResponse' function leaks up to 256 bytes of error body content from non-200 responses, along with Content-Type headers and redirect URLs. Operator-managed Red Hat Quay deployments are generally protected as they auto-configure PSK by default.
Affected products
- Quay Claircore <= 1.5.52
- Red Hat Clair 3
Timeline
- 2026-06-01: disclosed: Initial disclosure and NVD publication
- 2026-06-01: advisory: GitHub Advisory published