CVE-2026-10517 Overview
CVE-2026-10517 is a Server-Side Request Forgery (SSRF) vulnerability in Clair, the open-source container vulnerability scanner. The fetcher component issues outbound HTTP requests to attacker-supplied URIs taken from manifest layer descriptors. Clair performs no IP address or URI scheme filtering before dispatching these requests. When Pre-Shared Key (PSK) authentication is not configured, unauthenticated attackers can submit manifests that target internal services or cloud metadata endpoints. The vulnerability is classified under [CWE-918]. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack path.
Critical Impact
Unauthenticated attackers can probe internal network resources and leak up to 256 bytes of response error body content through reflective SSRF.
Affected Products
- Clair (fetcher component)
- Red Hat Quay deployments without PSK authentication enabled
- Container registry environments embedding Clair for vulnerability scanning
Discovery Timeline
- 2026-06-01 - CVE-2026-10517 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10517
Vulnerability Analysis
Clair scans container images by parsing manifests and fetching layer content referenced by Uniform Resource Identifiers (URIs) embedded in layer descriptors. The fetcher component dispatches HTTP requests to those URIs without validating the destination address or scheme. An attacker submits a crafted manifest whose layer descriptors point at internal IP ranges, link-local addresses such as 169.254.169.254, or non-HTTP schemes. Clair then issues the request from its own network position. The SSRF is reflective: when the target returns a non-200 response, Clair surfaces error data through CheckResponse error messages, leaking up to 256 bytes of the response body back to the attacker. This permits enumeration of internal services and partial extraction of cloud instance metadata.
Root Cause
The fetcher accepts arbitrary URIs from untrusted manifest input and does not enforce an allowlist of destinations, block private IP ranges, or restrict schemes to HTTPS. Authentication via PSK is opt-in rather than required by default, so deployments that skip PSK configuration expose the manifest submission endpoint to unauthenticated clients.
Attack Vector
The attack is delivered over the network. The attacker submits a manifest containing a layer descriptor whose URI references an internal endpoint, for example http://169.254.169.254/latest/meta-data/ on AWS or an internal management API. The fetcher dispatches the request from within the Clair deployment's trust boundary. Non-200 responses are reflected as error content, allowing iterative probing of internal services without code execution.
No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-10517 Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-10517
Indicators of Compromise
- Outbound HTTP requests from Clair fetcher pods or processes to private IP ranges (RFC1918), link-local addresses (169.254.0.0/16), or loopback interfaces.
- Manifest submissions containing layer descriptor URIs that reference internal hostnames, cloud metadata endpoints, or non-standard schemes.
- Repeated CheckResponse error log entries containing fragments of internal service responses.
Detection Strategies
- Inspect Clair access logs for manifest submissions originating from unauthenticated clients when PSK is expected to be enabled.
- Correlate Clair egress traffic with destination IP classification, flagging connections to RFC1918, link-local, or loopback ranges.
- Hunt for high-volume manifest submissions paired with repetitive fetcher errors, which suggests SSRF probing.
Monitoring Recommendations
- Forward Clair application logs and egress NetFlow data to a centralized analytics platform for correlation.
- Alert on cloud instance metadata service access patterns originating from scanner workloads.
- Track manifest ingestion rates and error response volumes to detect enumeration attempts.
How to Mitigate CVE-2026-10517
Immediate Actions Required
- Enable PSK authentication on all Clair deployments to block unauthenticated manifest submissions.
- Apply the Clair update referenced in the Red Hat CVE-2026-10517 Advisory once available in your distribution.
- Audit network egress policies for Clair workloads and deny traffic to internal ranges and cloud metadata endpoints.
Patch Information
Consult the Red Hat CVE-2026-10517 Advisory for fixed versions and distribution-specific package updates. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector, but should still apply vendor patches when published.
Workarounds
- Configure PSK authentication so all manifest submissions require a shared secret, removing the unauthenticated attack path.
- Enforce egress filtering at the network layer to block Clair from reaching 169.254.169.254, RFC1918 ranges, and loopback addresses.
- Restrict Clair fetcher to an allowlist of registry hostnames using a forward proxy or service mesh policy.
- Disable Instance Metadata Service Version 1 (IMDSv1) on cloud hosts running Clair and require IMDSv2 with hop-limit restrictions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
