Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2026-15927 A flaw was found in Red Hat Quay's repository-level mirror configuration feature

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Produits et versions touchés

Produit Versions touchées Corrigé en
mirror registry for Red Hat OpenShift 2 Versions non publiées
Red Hat Quay 3 Versions non publiées
Red Hat Quay 3.9 1785950004 premières → < 1785950004 1785950004
Red Hat Quay 3.12 1786170635 premières → < 1786170635 1786170635
Red Hat Quay 3.10 1786395065 premières → < 1786395065 1786395065
Red Hat Quay 3.17 1786181981 premières → < 1786181981 1786181981
Red Hat Quay 3.1 1786395065 premières → < 1786395065 1786395065
Red Hat Quay 3.15 1788191755 premières → < 1788191755 1788191755
Red Hat Quay 3.16 1789563753 premières → < 1789563753 1789563753
Afficher l’autre branche
Produit Versions touchées Corrigé en
Red Hat Quay 3.14 1788593843 premières → < 1788593843 1788593843

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de mirror registry for Red Hat OpenShift 2

Les 13 CVE de mirror registry for Red Hat OpenShift 2 →
CVE-2026-85471 A flaw was found in Quay 6.4 Moyenne CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Moyenne CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 Élevée CVE-2026-32591 A flaw was found in Red Hat Quay's Proxy Cache configuration feature 5.2 Moyenne
Suivre cette CVE