CVE-2026-32591
Server-Side Request Forgery in Red Hat Quay Proxy Cache
Publication date: 2026-04-08
Last updated on: 2026-04-21
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | quay | 3.0.0 |
| redhat | mirror_registry_for_red_hat_openshift | * |
| redhat | mirror_registry_for_red_hat_openshift | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Red Hat Quay's Proxy Cache configuration feature allows an attacker with organization administrator privileges to cause the Quay server to make unauthorized network requests to internal services or cloud infrastructure endpoints. This could potentially lead to unauthorized access to sensitive internal resources or data.
Such unauthorized access risks could impact compliance with standards and regulations like GDPR or HIPAA, which mandate strict controls over access to sensitive personal or health information and require protection against unauthorized data exposure.
However, the provided information does not explicitly state the direct compliance impact or any specific regulatory violations resulting from this vulnerability.
Can you explain this vulnerability to me?
CVE-2026-32591 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry, Quay connects to the specified hostname without verifying if it is a legitimate external service.
An attacker with organization administrator privileges can supply a crafted hostname that causes Quay to make requests to internal network services, cloud infrastructure endpoints, or other sensitive resources that should not be accessible from the Quay application.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with organization administrator access to make unauthorized network requests from the Quay server to internal or cloud infrastructure resources.
Such unauthorized access could lead to exposure of sensitive internal services, cloud metadata, or other protected resources, potentially compromising confidentiality and integrity within the affected environment.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network connections initiated by the Red Hat Quay server, specifically those made to unexpected or internal hostnames that should not be accessed by the proxy cache feature.
Since the vulnerability involves the upstream_registry parameter being set to a malicious hostname, reviewing the proxy cache configuration for any suspicious or unauthorized hostnames is essential.
Commands to detect potential exploitation could include network monitoring tools to capture outbound connections from the Quay server, such as:
- Using tcpdump or similar to monitor outbound connections: tcpdump -i <interface> host <internal_ip_range>
- Checking active connections with netstat or ss: netstat -tnp | grep quay or ss -tnp | grep quay
- Reviewing proxy cache configuration files or API settings for suspicious upstream_registry hostnames.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting organization administrator privileges to trusted users only, as exploitation requires authenticated access.
Review and validate all proxy cache configurations to ensure that upstream_registry hostnames point only to legitimate external registries.
Monitor and block any network requests from the Quay server to internal IP ranges or cloud metadata service endpoints that should not be accessible.
Apply any available patches or updates from Red Hat that address this vulnerability as soon as they are released.