CVE-2026-74247: redhat openshift_update_service Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-74247 is a high (CVSS 7.1) Server-Side Request Forgery (SSRF) vulnerability in redhat openshift_update_service. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities.

Timeline

1. 14-08-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.