CVE-2026-74247: Quay: ssrf via build archive_url in quay build api
A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
Other sources
A flaw was found in Red Hat Quay's build API. The endpoints/api/build.py endpoint accepts an archiveurl parameter with only an http/https scheme check and no SSRF validation. The URL is stored and passed to the builder fetch path, allowing a user with FEATUREBUILDSUPPORT enabled and repository write access to make the Quay builder issue requests to internal network addresses. This is a distinct code path from CVE-2026-16910 (webhook/Slack notification SSRF) with different privilege requirements and impact profile.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Quay build API code in endpoints/api/build.py so the archive_url parameter is rejected unless it passes SSRF validation (the current implementation only performs an http/https scheme check). Ensure the builder fetch path does not allow requests to internal network addresses.
Red Hat Quay build API (endpoints/api/build.py) archive_url SSRF validation = Add SSRF validation to block internal network addresses and other disallowed destinations (beyond http/https scheme check) - Configuration
Disable or restrict FEATURE_BUILD_SUPPORT, since the SSRF can be exploited by a user who has FEATURE_BUILD_SUPPORT enabled and repository write access to make the builder issue requests to internal network addresses.
Red Hat Quay FEATURE_BUILD_SUPPORT FEATURE_BUILD_SUPPORT = Disable for users unless required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74247?
The severity of CVE-2026-74247 is classified as medium with a score of 4.2.
How do I fix CVE-2026-74247?
To fix CVE-2026-74247, disable the FEATURE_BUILD_SUPPORT for users who do not require it or restrict repository write access.
What type of vulnerability is CVE-2026-74247?
CVE-2026-74247 is a Server-Side Request Forgery (SSRF) vulnerability.
Which software is affected by CVE-2026-74247?
CVE-2026-74247 affects Red Hat Quay.
Who can exploit CVE-2026-74247?
A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit CVE-2026-74247.