CVE-2026-2377

published 2026-04-08

CVE-2026-2377: A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the…

medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redhat	mirror_registry_for_red_hat_openshift	—	—
redhat	quay	—	—

CWE-918