Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 2 products
CVE-2026-2377 A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the applicat… https://www.cve.org/CVERecord?id=CVE-2026-2377
Post summary
The entry discloses CVE-2026-2377, noting that authenticated users can abuse the log export feature via a crafted URL, without mentioning PoC, exploit tools, patches, or active exploitation.
CVE-2026-2377 Server-Side Request Forgery in Mirror-Registry Log Export Feature https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2377 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A brief disclosure of CVE-2026-2377 notes it as an SSRF vulnerability in Mirror‑Registry Log Export, with no PoC, exploit, patch, or activity details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | mirror_registry_for_red_hat_openshift | - | - | - |
| App | redhat | mirror_registry_for_red_hat_openshift | 2.0 | - | - |
| App | redhat | quay | 3.0.0 | - | - |