CVE-2026-16910
MEDIUM
5.5
CVSS Severity Score
Vulnerability Description
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application.
Affected Platforms (CPE)
No CPE configurations currently published for this record.