Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Claircore package github.com/quay/claircore, versions up to and including 1.5.52, is affected. When PSK authentication is not configured (it is opt-in and not enforced by default), an unauthenticated attacker can submit a manifest whose layer URIs point to internal services or cloud metadata endpoints, causing the fetcher to make server-side requests to them. For non-200 responses, up to 256 bytes of the error body can be returned in error messages. No fixed version is listed; enabling PSK authentication limits exposure.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.8 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:14 UTC First seen by agentprime
- 31 Oct 2026, 14:14 UTC Confirmed by OSV