# CVE-2026-2376: Red Hat mirror-registry SSRF via Open Redirect in Quay

Source: https://junglewise.ai/threats/cve-2026-2376-red-hat-mirror-registry-ssrf-via-open-redirect-in-quay  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-2376 · Severity: medium · CVSS 4.9 · Published 2026-03-12

Red Hat mirror-registry and Quay are tools used to manage and mirror container images within enterprise environments. A security flaw allows an authenticated user to provide a malicious web address that tricks the system into connecting to internal or restricted servers it should not access. This could lead to the exposure of sensitive internal data or unauthorized access to private network resources.

Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-2376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2376 being exploited in the wild.

**How severe is CVE-2026-2376?** Medium severity, with a CVSS score of 4.9, published 12 March 2026.

**Which products and versions are affected?** Red Hat Mirror-Registry unspecified.

**Is there a fix for CVE-2026-2376?** A patch was published on 2026-02-16: Fix merged in Quay GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2376 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-2376?** Check whether you run Red Hat Mirror-Registry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat mirror-registry and Quay, specifically within the organization mirroring API and log export callback functionality. The application fails to properly validate user-supplied URLs and automatically follows redirects without verifying the final destination. An authenticated attacker can provide a malicious URL that, when processed by a backend worker, routes requests to internal or restricted systems (such as cloud metadata services or private network IPs). The fix involves implementing DNS-resolved validation against private/reserved IP ranges and introducing an allowlist configuration (SSRF_ALLOWED_HOSTS).

## Affected products

- Red Hat mirror-registry unspecified
- Red Hat Quay 3.0.0

## Timeline

- 2026-02-11: disclosed: Initial report in Red Hat Bugzilla
- 2026-02-16: patched: Fix merged in Quay GitHub repository
- 2026-03-12: advisory: NVD and Red Hat published advisory

## References

- [https://access.redhat.com/security/cve/CVE-2026-2376](https://access.redhat.com/security/cve/CVE-2026-2376)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2439117](https://bugzilla.redhat.com/show_bug.cgi?id=2439117)
- [https://github.com/quay/quay/pull/5074](https://github.com/quay/quay/pull/5074)

## Related threats

- [Red Hat mirror-registry SSRF in log export feature](https://junglewise.ai/threats/cve-2026-2377-red-hat-mirror-registry-ssrf-in-log-export-feature)