CVE-2026-74247 is a server-side request forgery flaw (CWE-918) in the build API of Red Hat Quay. A user with repository write access can supply a URL that makes the builder contact internal addresses. The record rates it Medium at 4.2. Disable build support if unused, and apply the update.
What's affected
The record lists Red Hat Quay and OpenShift Update Service as affected, with no version ranges. Red Hat's CVE page rates it Moderate. It applies only when FEATURE_BUILD_SUPPORT is enabled, and the user needs write access to a repository.
Severity, as two sources state it. The record scores 4.2 (Medium) with low confidentiality impact, matching Red Hat and cve.org. The NVD vector on Red Hat's page lists high confidentiality impact, which would give a higher score. The sources agree on the conditions: a login, build support on, and repository write rights.
How to check if you're exposed
Red Hat Quay does not publish a single version number in the record, so start with your own deployment.
oc get csv -A | grep -i quay
oc get quayregistry -A
These commands apply to Quay run on OpenShift through the operator. For a standalone installation, check the Quay image tag in your deployment files. Then compare it with the fixed releases on the Red Hat CVE page linked under Sources, since the record lists affected products but no fixed versions. Red Hat's page is the place to confirm which errata apply to your subscription.
Check the Quay configuration for FEATURE_BUILD_SUPPORT. If it is false or absent, this issue does not apply.
What to do now
- Disable FEATURE_BUILD_SUPPORT if you do not need builds, as Red Hat advises.
- Apply the Red Hat update after confirming the release on the CVE page.
- Limit network access from the builder to internal services, including the cloud metadata address.
- Review who has write access to repositories and remove any that is not needed.
- Check build logs for archive URLs that point to internal hosts.
Why it matters
The weakness is server-side request forgery, CWE-918. The build API takes an archive URL and the Quay builder fetches it. The record says a user can provide a URL pointing at an internal network address, so the request comes from the builder host instead of from the user. Firewalls usually trust that host more than they trust the internet.
The effect is the disclosure of internal information, which is why impact is low to moderate. Strong egress rules on builders are the best backstop: a builder rarely needs to reach anything beyond a registry and a source host. KEV status is false.
Quick check
Do I need to worry if I never use builds?
If FEATURE_BUILD_SUPPORT is disabled, the vulnerable endpoint is not in use. Check the setting to be sure.
What can an attacker learn?
The record says internal information could be disclosed through requests made by the builder.
Sources
Last reviewed: 18 October 2026.
