CVE-2026-10517

mediumrejectedpriority · track · 0EUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
— EPSS
CVSS 5.8 · medium
Is it mine?
2 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · osv

Rejected reason: Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/claircore: the authentication mechanism in question (optional PSK, HTTP endpoint /indexer/api/v1/index_report) is implemented entirely in github.com/quay/clair; no PSK-related code exists anywhere in claircore's codebase or git history. The unauthenticated indexer API is Clair's documented, intentional design, authentication is an opt-in deployment choice, not a code defect. No fix commit was found in claircore between the version recorded as the affected boundary (1.5.52) and the following release (1.5.53); intervening commits are unrelated dependency and feature changes, so the "fixed in 1.5.52" status is inaccurate.

01

cvss

Technical severity, 0–10. One row per scoring source.

5.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:Nsecondary · ENISA EU
v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:Nsecondary · OSV
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918US
03

affected products (2)

Products and version ranges known to be affected.

04

advisories (2)

Vendor and ecosystem advisories describing this.

  • GHSA-698x-9w2p-7vvpClaircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints2026-06-01ghsa · osvUS

    A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.

  • GO-2026-5939Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore2026-07-17vendor · osvUS

    Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore

05

also known as (5)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvNVDCVE.orgMITRE
published 2026-06-01modified 2026-07-27
07

references (1) cnnvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan