CVE-2026-74247 Quay: ssrf via build archive_url in quay build api

What is CVE-2026-74247?

CVE-2026-74247 is a medium-severity server-side request forgery vulnerability in Red Hat OpenShift Update Service, published on 14 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

Weakness: CWE-918

Which versions are affected by CVE-2026-74247?

It affects 2 products.

Products include Redhat Openshift Update Service, Redhat Quay.

How do I fix CVE-2026-74247?

No fix has been published for CVE-2026-74247 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-74247 being exploited?

There is no known exploitation of CVE-2026-74247 in the wild and no public exploit code.

Other vulnerabilities in Red Hat OpenShift Update Service

• CVE-2026-74243 Quay: unauthenticated secscan notification endpoint in quay when psk is unset Medium 6.5
• CVE-2025-57854 Osus-operator: privilege escalation via excessive /etc/passwd permissions Medium 6.4
• CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay Medium 5.9
• CVE-2026-74245 Quay: unauthenticated exported logs download in quay Medium 5.9
• CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rg7f-fcx2-cjw3.