VulnerabilityAwaiting Analysis

CVE-2026-10052

An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering.

MEDIUM 4.1EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering. This allows the attacker to perform internal network reconnaissance from the Quay pod's network position, potentially mapping the internal network infrastructure.

CVSS 3.1: 4.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.19% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-918
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.