CVE-2026-85471 Red Hat CVE debrief

Who should care

Quay administrators and security teams should assess exposure and apply remediation to prevent potential SSRF attacks. They should verify inventory of affected Quay versions and apply vendor remediation. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-85471 is a medium-severity vulnerability in Quay that allows authenticated administrators to bypass the hostname blacklist in webhook notifications, potentially leading to SSRF attacks and disclosure of sensitive information. Quay administrators and security teams should assess exposure, verify inventory of affected versions, and apply vendor remediation.

• Potential disclosure of sensitive information from internal services
• Possible unauthorized access to internal network resources
• Need for verification of affected Quay versions and inventory
• Priority for applying vendor remediation

Technical summary

The Quay application is vulnerable to Server-Side Request Forgery (SSRF) due to a flaw in the webhook notification hostname blacklist. An authenticated repository administrator can bypass this blacklist, potentially leading to the disclosure of sensitive information from internal services. The vulnerability affects Quay installations with webhook notifications enabled and has a medium severity. Administrators and security teams should assess exposure and apply remediation to prevent potential SSRF attacks. The vulnerability can be mitigated by verifying inventory of affected Quay versions and applying vendor remediation.

Defensive priority

Assess exposure of Quay installations, particularly those with webhook notifications enabled. Verify inventory of affected Quay versions and apply vendor remediation.

Recommended defensive actions

• Assess exposure of Quay installations, particularly those with webhook notifications enabled
• Verify inventory of affected Quay versions
• Apply vendor remediation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Red Hat provides additional context through their security advisory. The vulnerability allows an authenticated repository administrator to bypass the hostname blacklist in webhook notifications, potentially leading to SSRF attacks and disclosure of sensitive information. The source item and CVE Program record provide details about the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.