Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Mirror Registry lets attackers access internal systems with fake URLs

CVE-2026-2376 · published 7 months ago
Summary

An attacker with an account can use fake web addresses to access internal systems they shouldn't have access to. This happens because the system doesn't check where the address actually leads. To fix this, update the Mirror Registry software to prevent it from following redirects without checking the final destination.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
redhat quay 3.0.0
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
redhat mirror_registry All versions
cpe:2.3:a:redhat:mirror_registry:-:*:*:*:*:openshift:*:*
Original advisory text
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the applic...
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.

When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published12 Mar 2026
Updated29 Oct 2026
First seen12 Mar 2026
Sources
CVE-2026-2376 · NVD
Track software like this
Free during beta