CVE-2026-15927 | A flaw was found in Red Hat Quay's repository-level mirror c… | CVSS 6.8 MEDIUM

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Metadata

CVE ID: CVE-2026-15927
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-16 06:31 UTC
Published: 2026-07-21 04:45 UTC
Last updated: 2026-07-21 04:45 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: Red Hat / mirror registry for Red Hat OpenShift 2
Sources: cve.org · NVD

Severity & Metrics

6.8 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected products (3)

Vendor	Product	Platform	Versions
Red Hat	mirror registry for Red Hat OpenShift 2	—	—
Red Hat	Red Hat Quay 3	—	—
Red Hat	Red Hat Quay 3	—	—

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.8	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References (2)