Skip to content
fr Sign in
6.8 Medium

CVE-2026-15927 A flaw was found in Red Hat Quay's repository-level mirror configuration feature

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Affected products and versions

Product Affected versions Fixed in
mirror registry for Red Hat OpenShift 2 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Quay 3.9 1785950004 earliest → < 1785950004 1785950004
Red Hat Quay 3.12 1786170635 earliest → < 1786170635 1786170635
Red Hat Quay 3.10 1786395065 earliest → < 1786395065 1786395065
Red Hat Quay 3.17 1786181981 earliest → < 1786181981 1786181981
Red Hat Quay 3.1 1786395065 earliest → < 1786395065 1786395065
Red Hat Quay 3.15 1788191755 earliest → < 1788191755 1788191755
Red Hat Quay 3.16 1789563753 earliest → < 1789563753 1789563753
Show the other branch
Product Affected versions Fixed in
Red Hat Quay 3.14 1788593843 earliest → < 1788593843 1788593843

References

Timeline

  1. Published
  2. Last modified

Other CVEs of mirror registry for Red Hat OpenShift 2

The 13 CVEs of mirror registry for Red Hat OpenShift 2 →
CVE-2026-85471 A flaw was found in Quay 6.4 Medium CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Medium CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 High CVE-2026-32591 A flaw was found in Red Hat Quay's Proxy Cache configuration feature 5.2 Medium
Track this CVE