Red Hat Quay Notification Webhook Vulnerability Reveals Security Flaw
CVE-2026-16910

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Update Service
Red Hat Quay 3
Vendor
CVE Published:
24 July 2026

What is CVE-2026-16910?

A security issue has been identified in Red Hat Quay's notification webhook feature, where the Slack and generic webhook handlers accept unvalidated user-supplied URLs. This vulnerability allows repository administrators to exploit the Quay worker, enabling it to make POST requests to internal network addresses or cloud endpoints, potentially exposing sensitive systems that should remain inaccessible from the application.

References

https://access.redhat.com/security/cve/CVE-2026-16910
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2506685
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Martin Brodeur for reporting this issue.
.