CVE-2026-15927
Received Received - Intake

SSRF Vulnerability in Red Hat Quay Repository Mirror Configuration

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15927
EUVD
EUVD-2026-46150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat quay *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay's repository-level mirror configuration feature. An authenticated repository administrator can exploit it by providing a malicious hostname in the external_reference parameter when enabling or updating repository mirroring through specific API endpoints. The input is stored without proper validation and later used to construct a docker:// URL for Skopeo, enabling unauthorized HTTP requests to internal services.

Detection Guidance

Check Quay API logs for suspicious POST/PUT requests to /api/mirror endpoints with external_reference parameters pointing to internal or unexpected hosts. Monitor Skopeo processes for outbound connections to cloud metadata endpoints or internal services.

Impact Analysis

An attacker with repository administrator privileges could access internal network services, cloud metadata endpoints, or other restricted resources not intended to be reachable from the Quay application. This could lead to data exfiltration, unauthorized access to sensitive systems, or disruption of internal services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using Red Hat Quay may face compliance violations if internal systems are accessed without authorization.

Mitigation Strategies

Apply the latest Red Hat Quay patch addressing SSRF in repository-level mirroring. Restrict repository administrator privileges to trusted users. Review and disable repository-level mirroring if not required. Monitor network traffic for unexpected outbound connections from Quay workers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart