CVE-2026-16910

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw exists in the notification webhook feature of Red Hat Quay. The Slack and generic webhook notification handlers do not perform Server-Side Request Forgery (SSRF) validation on user-supplied URLs. This allows a repository administrator to force the Quay worker to send POST requests to internal network addresses or cloud infrastructure endpoints that are intended to be unreachable from the application. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.