Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-15927

Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Quay 3.10

Default version status: affected

  • 1786395065 to < *unaffected

Red Hat Red Hat Quay 3.12

Default version status: affected

  • 1786170635 to < *unaffected

Red Hat Red Hat Quay 3.14

Default version status: affected

  • 1788593843 to < *unaffected

Red Hat Red Hat Quay 3.15

Default version status: affected

  • 1788191755 to < *unaffected

Red Hat Red Hat Quay 3.16

Default version status: affected

  • 1789563753 to < *unaffected

Red Hat Red Hat Quay 3.17

Default version status: affected

  • 1786181981 to < *unaffected

Red Hat Red Hat Quay 3.9

Default version status: affected

  • 1785950004 to < *unaffected

Red Hat mirror registry for Red Hat OpenShift 2

Default version status: affected

References