SSRF Vulnerability in Red Hat Quay Repository Configuration
CVE-2026-15927

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Mirror Registry For Red Hat Openshift 2
Red Hat Quay 3
Vendor
CVE Published:
21 July 2026

What is CVE-2026-15927?

A security flaw has been discovered in the repository mirror configuration of Red Hat Quay, specifically within the POST and PUT handlers located in endpoints/api/mirror.py. These handlers process an external_reference parameter without proper Server-Side Request Forgery (SSRF) validation, unlike the organization-level handlers, which do utilize validation mechanisms like validate_external_registry_url(). As a result, a repository administrator has the ability to input a specially crafted hostname, enabling the Quay mirror worker to initiate requests to sensitive internal network services, unauthorized cloud metadata endpoints, or other protected resources that should not be accessible from the Quay application.

References

https://access.redhat.com/security/cve/CVE-2026-15927
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2501256
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat).
.