Vulnerability record/PUBLISHED/Published Mar 12, 2026 19:11:16 UTC
CVE-2026-2376
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Base score4.9/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityHighAC
Privileges requiredLowPR
User interactionNoneUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 1, 2026 05:06:40 UTC
PublishedMar 12, 2026 19:11:16 UTC
ReservedFeb 11, 2026 20:57:36 UTC
Credits
- Red Hat would like to thank Antony Di Scala, Luffy Zhang, and Michael Whale for reporting this issue.