A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Red Hat mirror registry for Red Hat OpenShift affected —
Red Hat mirror registry for Red Hat OpenShift 2 affected —
Red Hat Red Hat Quay 3 affected —
Red Hat Red Hat Quay 3 affected —

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Redhat Subscribe
Mirror Registry Subscribe
Quay Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2026-2377 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2439201 cve-icon cve-icon
History

Wed, 08 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.
Title Mirror-registry: quay: quay: server-side request forgery via log export functionality
First Time appeared Redhat
Redhat mirror Registry
Redhat quay
Weaknesses CWE-918
CPEs cpe:/a:redhat:mirror_registry:1
cpe:/a:redhat:mirror_registry:2
cpe:/a:redhat:quay:3
Vendors & Products Redhat
Redhat mirror Registry
Redhat quay
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-04-08T16:26:07.649Z

Reserved: 2026-02-11T20:57:59.704Z

Link: CVE-2026-2377

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-08T17:21:16.237

Modified: 2026-04-08T17:21:16.237

Link: CVE-2026-2377

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses