CVE-2026-2376

Katalog CVE

CVSS 5.4 · Medium EPSS 0,16%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada redhat quay, redhat mirror registry. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-2376 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2439117 advisory vendor
• https://github.com/quay/quay/pull/5074 issue tracking · patch