CVE-2026-15927: Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-11-01
Weakness: CWE-918

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Affected products

Red Hat mirror registry for Red Hat OpenShift 2: all versions
Red Hat Quay 3.10: all versions — fixed in 1786395065
Red Hat Quay 3.12: all versions — fixed in 1786170635
Red Hat Quay 3.14: all versions — fixed in 1788593843
Red Hat Quay 3.15: all versions — fixed in 1788191755
Red Hat Quay 3.16: all versions — fixed in 1789563753
Red Hat Quay 3.17: all versions — fixed in 1786181981
Red Hat Quay 3.9: all versions — fixed in 1785950004

How to fix

Upgrade to a fixed version: Red Hat Quay 3.10 1786395065; Red Hat Quay 3.12 1786170635; Red Hat Quay 3.14 1788593843; Red Hat Quay 3.15 1788191755; Red Hat Quay 3.16 1789563753; Red Hat Quay 3.17 1786181981; Red Hat Quay 3.9 1785950004. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-15927 or the next vulnerability affects your stack