A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-10517 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/claircore: the authentication mechanism in question (optional PSK, HTTP endpoint /indexer/api/v1/index_report) is implemented entirely in github.com/quay/clair; no PSK-related code exists anywhere in claircore's codebase or git history. The unauthenticated indexer API is Clair's documented, intentional design, auth…
CVE-2026-10517
✕ Withdrawn — historical dataMEDIUMPre-NVD 5.8
5.8CVSS
- CVSS v3
- 5.8
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
June 1, 2026
Last Modified
July 22, 2026
References (2)
- secalert@redhathttps://access.redhat.com/security/cve/CVE-2026-10517
- secalert@redhathttps://bugzilla.redhat.com/show_bug.cgi?id=2486779
Frequently asked(4)
What is CVE-2026-10517?
CVE-2026-10517 is a rejected CVE ID: its record was withdrawn on July 27, 2026 and no longer describes a vulnerability. Reason given: Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/claircore: the authentication mechanism in question (optional PSK, HTTP endpoint /indexer/api/v1/index_report) is implemented entirely in github.com/quay/clair; no PSK-related code exists anywhere in claircore's codebase or git history. The unauthenticated indexer API is Clair's documented, intentional design, auth…
When was the CVE record for CVE-2026-10517 published?
The CVE record for CVE-2026-10517 was published on June 1, 2026. EchelonGraph's copy of the record carries a last-modified date of July 22, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-10517?
CVE-2026-10517 has a CVSS base score of 5.8 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-10517?
There is nothing to remediate under CVE-2026-10517: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.