Vulnerability record/PUBLISHED/Published Jul 21, 2026 04:45:27 UTC

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Base score6.8/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredHighPR

User interactionNoneUI

ScopeChangedS

Confidentiality impactHighC

Integrity impactNoneI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityredhat

Last updatedNov 1, 2026 04:52:14 UTC

PublishedJul 21, 2026 04:45:27 UTC

ReservedJul 16, 2026 06:31:41 UTC

Credits

This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat).