A flaw was found in Quay.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 12, 2026 · NIST NVD

   Detected

   A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the

2. Oct 14, 2026 · NIST NVD

   Updated

   A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the

Sources

• CVE.orgVulnerability recordCVE-2026-85471

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-85471

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-85471

  A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal networ

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · bugzilla.redhat.com