CVE-2026-16910

5.5 mediumEPSS 0.3%

Medium (5.5). EPSS 0.3% chance of exploitation in the next 30 days.

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-07-24
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

References

https://access.redhat.com/security/cve/CVE-2026-16910
https://bugzilla.redhat.com/show_bug.cgi?id=2506685

Check your stack JSON