CVE-2026-10052
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints
A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering. This allows the attacker to perform internal network reconnaissance from the Quay pod's network position, potentially mapping the internal network infrastructure.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Quay 3
- Vendor
- Red Hat
- Product
- Red Hat Quay 3
- Platforms
- Unknown
- Default status
affected- Package
- quay/quay-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Quay 3
- Vendor
- Red Hat
- Product
- Red Hat Quay 3
- Platforms
- Unknown
- Default status
affected- Package
- quay/quay-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.