Listen to this Post
A flaw was found in Red Hat Quay. A user with `FEATURE_BUILD_SUPPORT` enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.
The vulnerability exists within Red Hat Quay’s build API functionality where users with specific permissions can exploit a server-side request forgery flaw that enables unauthorized access to internal network resources. The issue specifically affects systems where `FEATURE_BUILD_SUPPORT` is enabled and users possess repository write access, creating a dangerous attack surface that could be leveraged by malicious actors to bypass normal network security controls.
The technical implementation of this vulnerability stems from insufficient input validation within the build API’s URL handling mechanism. When a user submits a malicious URL through the build process, the Quay builder component fails to properly sanitize or validate the provided URI before initiating outbound network requests. This allows attackers to craft URLs that target internal services or resources that would normally be inaccessible from external networks, effectively circumventing firewall and network segmentation controls that typically protect sensitive internal systems.
From an operational perspective, this vulnerability presents significant risk to organizations relying on Red Hat Quay for container image building and deployment processes. Attackers could potentially enumerate internal services, access sensitive configuration data, retrieve internal documentation, or even exploit vulnerable internal systems that are not directly exposed to the internet. The impact extends beyond simple information disclosure as it provides a potential foothold for further lateral movement within the network infrastructure.
The vulnerability aligns with CWE-918, which specifically addresses server-side request forgery issues where attackers can manipulate a server into making unintended requests to internal resources. This weakness falls under the broader category of insecure direct object references and can be mapped to ATT&CK technique T1071.004 for application layer protocol tunneling.
The CVSS score is 4.2, indicating medium severity. The vector string is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue.
DailyCVE Form:
Platform: Red Hat Quay
Version: All versions prior to patched release
Vulnerability: SSRF (CWE-918)
Severity: 4.2 (Medium)
Date: 08/14/2026
Prediction: Patch expected Q4 2026
What Undercode Say:
Check if FEATURE_BUILD_SUPPORT is enabled
grep FEATURE_BUILD_SUPPORT /etc/quay/config.yaml
Test SSRF vulnerability (Educational Purposes only)
curl -X POST https://quay.example.com/api/v1/build \
-H "Authorization: Bearer <token>" \
-d '{"archive_url":"http://169.254.169.254/latest/meta-data/"}'
Monitor builder egress traffic
tcpdump -i any dst net 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16
Exploit: (Educational Purposes!)
- Authenticate to Red Hat Quay with a user that has repository write access
- Ensure `FEATURE_BUILD_SUPPORT` is enabled on the Quay instance
- Craft a malicious URL pointing to internal network addresses (e.g., `http://169.254.169.254/latest/meta-data/` for cloud metadata, `http://localhost:8080/admin`, or internal IP ranges like
10.0.0.0/8) - Submit the malicious URL via the build API `archive_url` parameter
- The Quay builder makes an outbound request to the internal target
- Response from internal service is returned to the attacker, disclosing sensitive information
Protection:
- Disable `FEATURE_BUILD_SUPPORT` if not essential:
quay config --set FEATURE_BUILD_SUPPORT=false systemctl restart quay-app
- Implement egress filtering on the Quay builder to block internal IP ranges:
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP iptables -A OUTPUT -d 172.16.0.0/12 -j DROP iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
- Validate all URLs against an allowlist before processing
- Restrict repository write permissions to trusted users only
- Implement network segmentation controls for the Quay builder component
- Monitor for anomalous outbound network requests from build processes
Impact:
- Information Disclosure: Attackers can access internal services, metadata endpoints, cloud instance metadata, exposing credentials, tokens, or sensitive data
- Lateral Movement: Provides a foothold for attackers to pivot to other internal systems
- Internal Service Enumeration: Attackers can probe internal network services and read responses, accessing internal dashboards, APIs, or configuration files
- Bypass of Network Controls: Circumvents firewall and network segmentation that protect sensitive internal systems
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
