CVE-2026-15927
MEDIUM
MEDIUM
Priority: 0.04
BB Relevance:
59/100
Published: 2026-07-21
Modified: 2026-11-01
First seen: 2026-11-01
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Changed
C:
High
I:
None
A:
None
Description
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Weakness Classification (1)
References & Advisories (9)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT