CVE-2026-74247
CVE-2026-74247: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.2
Medium [CVE-2026-74247] SSRF via build archive_url in Quay build API
CVE-2026-74247Source published Source updated
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information. Exploitation requires specific configuration and privileges, limiting the attack surface. Successful exploitation could enable access to internal network resources from the Quay builder. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-918. Affected Red Hat products: Red Hat OpenShift Update Service; Red Hat Quay 3. Red Hat does not currently list a…
- Affected products in this advisory
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- To mitigate this issue, disable the `FEATURE_BUILD_SUPPORT` feature in Red Hat Quay if it is not essential for your operations. This action prevents the vulnerable build API endpoint from being exploited. Refer to the Red Hat Quay product documentation for detailed instructions on managing and disabling features.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.