SSRF Vulnerability in Red Hat Quay Repository Configuration

CVE-2026-15927

What is CVE-2026-15927?

A security flaw has been discovered in the repository mirror configuration of Red Hat Quay, specifically within the POST and PUT handlers located in endpoints/api/mirror.py. These handlers process an external_reference parameter without proper Server-Side Request Forgery (SSRF) validation, unlike the organization-level handlers, which do utilize validation mechanisms like validate_external_registry_url(). As a result, a repository administrator has the ability to input a specially crafted hostname, enabling the Quay mirror worker to initiate requests to sensitive internal network services, unauthorized cloud metadata endpoints, or other protected resources that should not be accessible from the Quay application.

References