{
  "threat_severity" : "Moderate",
  "public_date" : "2026-08-14T00:00:00Z",
  "bugzilla" : {
    "description" : "quay: SSRF via build archive_url in Quay build API",
    "id" : "2516144",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2516144"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.2",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-918",
  "details" : [ "A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.", "A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information." ],
  "statement" : "This Moderate impact flaw in Red Hat Quay's build API allows an authenticated user with repository write access and the `FEATURE_BUILD_SUPPORT` feature enabled to perform Server-Side Request Forgery (SSRF) attacks. Exploitation requires specific configuration and privileges, limiting the attack surface. Successful exploitation could enable access to internal network resources from the Quay builder.",
  "acknowledgement" : "Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue.",
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Update Service",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift-update-service/openshift-update-service-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_update_service:5"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Fix deferred",
    "package_name" : "quay/quay-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Fix deferred",
    "package_name" : "quay/quay-rhel9",
    "cpe" : "cpe:/a:redhat:quay:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-74247\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74247" ],
  "name" : "CVE-2026-74247",
  "mitigation" : {
    "value" : "To mitigate this issue, disable the `FEATURE_BUILD_SUPPORT` feature in Red Hat Quay if it is not essential for your operations. This action prevents the vulnerable build API endpoint from being exploited. Refer to the Red Hat Quay product documentation for detailed instructions on managing and disabling features.",
    "lang" : "en:us"
  },
  "csaw" : false
}