CVE-2026-15927 is a SSRF vulnerability in Red Hat Quay's repository-level mirror configuration. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without proper SSRF validation, unlike organization-level mirror handlers that apply validate_external_registry_url(). This allows an authenticated repository administrator to supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other unintended resources. The flaw is limited to authenticated administrators and can be mitigated by restricting network egress from Quay mirror worker pods/containers, limiting repository creation and admin privileges, or disabling repository-level mirroring.

An authenticated repository administrator can exploit this SSRF vulnerability to make the Quay mirror worker connect to internal network services or cloud metadata endpoints. This may expose sensitive internal resources that are not intended to be reachable from the Quay application. The vulnerability impacts confidentiality but does not affect integrity or availability. The risk is limited by the requirement for administrator privileges.

Red Hat has released an update for Red Hat Quay (e.g., version 3.9.25 and presumably 3.15.8) that addresses this vulnerability. Users should apply the official Red Hat security advisory update RHSA-2026:50931. Additionally, network egress from Quay mirror worker pods/containers should be restricted using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Repository creation and admin privileges should be limited to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy.