Home

Description

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

PUBLISHED Reserved 2026-02-11 | Published 2026-03-12 | Updated 2026-03-12 | Assigner redhat




MEDIUM: 4.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2026-02-11:Reported to Red Hat.
2026-03-03:Made public.

Credits

Red Hat would like to thank Antony Di Scala, Luffy Zhang, and Michael Whale for reporting this issue.

References

access.redhat.com/security/cve/CVE-2026-2376 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2439117 (RHBZ#2439117) issue-tracking

github.com/quay/quay/pull/5074

cve.org (CVE-2026-2376)

nvd.nist.gov (CVE-2026-2376)

Download JSON