Riskcovery

CVE-2026-15927

Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

State
Published
Severity
6.8 Medium
Published
Jul 21, 2026
Updated
Nov 1, 2026
Reserved
Jul 16, 2026

Read the record on cve.org

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:Nredhat

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
Red Hat Quay 3.10Red Hat
  • 1786395065 and laterNot affected
Red Hat Quay 3.12Red Hat
  • 1786170635 and laterNot affected
Red Hat Quay 3.14Red Hat
  • 1788593843 and laterNot affected
Red Hat Quay 3.15Red Hat
  • 1788191755 and laterNot affected
Red Hat Quay 3.16Red Hat
  • 1789563753 and laterNot affected
Red Hat Quay 3.17Red Hat
  • 1786181981 and laterNot affected
Red Hat Quay 3.9Red Hat
  • 1785950004 and laterNot affected
mirror registry for Red Hat OpenShift 2Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.