CVE-2026-16910: Red Hat Quay SSRF Vulnerability

CVE-2026-16910 Overview

CVE-2026-16910 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without validating them against internal or restricted network ranges. A repository administrator can configure notification endpoints that point to internal network addresses or cloud infrastructure metadata endpoints. The Quay worker then issues POST requests to those destinations, exposing services that should not be reachable from the application. The flaw is tracked under CWE-918 and requires authenticated repository-admin privileges.

Critical Impact
An authenticated repository administrator can coerce the Quay worker to send POST requests to internal services, enabling reconnaissance of internal networks and access to cloud metadata endpoints.

Affected Products

Red Hat Quay (notification webhook feature)
Slack notification handler
Generic webhook notification handler

Discovery Timeline

2026-07-24 - CVE-2026-16910 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-16910

Vulnerability Analysis

Red Hat Quay is a private container registry that supports event-driven notifications through webhooks. Repository administrators can configure notifications to trigger on events such as image pushes, vulnerability findings, or build completions. Two of these handlers, the Slack notifier and the generic webhook notifier, accept a target URL from the administrator and dispatch HTTP POST requests to it from the Quay worker process.

The handlers do not validate the destination URL against a denylist of internal addresses or restricted CIDR ranges. As a result, the Quay worker will resolve and connect to any hostname or IP provided, including 127.0.0.1, RFC1918 ranges, link-local addresses, and cloud metadata endpoints such as 169.254.169.254. Because the request originates from inside the trust boundary of the Quay deployment, it can reach services that are firewalled from external callers.

Root Cause

The root cause is missing input validation on the URL supplied to the notification configuration. The webhook handler treats the URL as arbitrary user input suitable for direct use in an outbound HTTP client, without applying an allowlist, hostname resolution check, or IP range filter before dispatching the request.

Attack Vector

Exploitation requires an authenticated user with repository administrator privileges on a Quay instance. The attacker configures a Slack or generic webhook notification with a target URL pointing to an internal resource. When a triggering event occurs, or the notification is tested, the Quay worker issues a POST request to the attacker-chosen destination. The response body is not returned to the attacker directly, but request timing, status codes, and side effects can be used to enumerate internal services or interact with unauthenticated internal APIs.

No verified public exploit code is available for this issue. See the Red Hat CVE-2026-16910 Advisory and Red Hat Bugzilla Report #2506685 for technical details.

Detection Methods for CVE-2026-16910

Indicators of Compromise

Notification configurations in Quay pointing to RFC1918 addresses, localhost, 127.0.0.1, or 169.254.169.254.
Outbound HTTP POST requests from Quay worker processes to internal IP ranges or cloud metadata endpoints.
Unexpected repository administrator activity creating or modifying Slack or generic webhook notifications.

Detection Strategies

Audit the Quay database or API for existing notification configurations and flag any URL whose resolved IP falls within internal or link-local ranges.
Inspect Quay worker egress logs for POST requests to non-public destinations, correlated with notification dispatch events.
Monitor Quay administrative audit logs for create_notification and update_notification actions targeting Slack or webhook methods.

Monitoring Recommendations

Enable egress network flow logging on the Quay worker nodes and alert on connections to metadata service IPs.
Forward Quay application and audit logs to a centralized analytics platform for correlation with configuration changes.
Track repository administrator role assignments and review privilege scope regularly.

How to Mitigate CVE-2026-16910

Immediate Actions Required

Review all existing Slack and generic webhook notifications and remove any that target internal or metadata addresses.
Restrict Quay repository administrator privileges to trusted users and enforce least privilege on notification configuration.
Apply network-level egress filtering on Quay worker nodes to block traffic to RFC1918 ranges and cloud metadata endpoints.

Patch Information

Refer to the Red Hat CVE-2026-16910 Advisory for fixed package versions and errata. Apply vendor-supplied updates once available for the affected Quay release stream.

Workarounds

Place the Quay worker in a network segment that denies egress to internal subnets and cloud metadata IPs by default.
Use an outbound HTTP proxy that enforces an allowlist of approved notification destinations (for example, hooks.slack.com).
Disable Slack and generic webhook notification methods where they are not required.

bash

# Example egress restriction using iptables on the Quay worker host
# Block access to AWS/GCP/Azure metadata endpoint
iptables -A OUTPUT -m owner --uid-owner quay -d 169.254.169.254 -j REJECT

# Block RFC1918 ranges from the Quay worker process
iptables -A OUTPUT -m owner --uid-owner quay -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quay -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quay -d 192.168.0.0/16 -j REJECT