A flaw was found in Red Hat Quay's repository-level mirror configuration feature. (CVE-2026-15927)
A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat Quay's repository-level mirror configuration feature. The flaw allows an authenticated repository administrator to supply a crafted hostname that causes the Quay mirror worker to make unauthorized requests to internal network services or cloud metadata endpoints. This vulnerability is due to lack of SSRF validation on the external_reference parameter in certain API handlers. The issue is rated with a CVSS score of 6.8 (medium severity).
AI Analysis
Technical Summary
CVE-2026-15927 is a vulnerability in Red Hat Quay's repository-level mirror configuration feature where the POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without proper SSRF validation. Unlike organization-level mirror handlers that apply validate_external_registry_url(), this omission allows an authenticated repository administrator to craft hostnames that cause the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other unintended resources. This SSRF vulnerability can expose sensitive internal resources. The flaw requires authenticated repository administrator privileges and has a CVSS v3.1 score of 6.8 with high confidentiality impact but no integrity or availability impact. The vendor advisory recommends restricting network egress from Quay mirror worker pods/containers and limiting repository creation and admin privileges. A fixed version, Red Hat Quay 3.9.25, is available.
Potential Impact
An authenticated repository administrator can exploit this SSRF vulnerability to cause the Quay mirror worker to make network requests to internal services or cloud metadata endpoints that are not intended to be accessible. This may lead to exposure of sensitive internal resources. The vulnerability does not impact integrity or availability but has a high confidentiality impact. The risk is limited to users with repository administrator privileges.
Mitigation Recommendations
Red Hat has released an official fix in Red Hat Quay version 3.9.25. Users should apply this update after ensuring all prior relevant errata are applied. Additionally, network egress from Quay mirror worker pods or containers should be restricted using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Repository creation and administrator privileges should be limited to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy.
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. (CVE-2026-15927)
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat Quay's repository-level mirror configuration feature. The flaw allows an authenticated repository administrator to supply a crafted hostname that causes the Quay mirror worker to make unauthorized requests to internal network services or cloud metadata endpoints. This vulnerability is due to lack of SSRF validation on the external_reference parameter in certain API handlers. The issue is rated with a CVSS score of 6.8 (medium severity).
CVSS v3.1
Score 6.8medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15927 is a vulnerability in Red Hat Quay's repository-level mirror configuration feature where the POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without proper SSRF validation. Unlike organization-level mirror handlers that apply validate_external_registry_url(), this omission allows an authenticated repository administrator to craft hostnames that cause the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other unintended resources. This SSRF vulnerability can expose sensitive internal resources. The flaw requires authenticated repository administrator privileges and has a CVSS v3.1 score of 6.8 with high confidentiality impact but no integrity or availability impact. The vendor advisory recommends restricting network egress from Quay mirror worker pods/containers and limiting repository creation and admin privileges. A fixed version, Red Hat Quay 3.9.25, is available.
Potential Impact
An authenticated repository administrator can exploit this SSRF vulnerability to cause the Quay mirror worker to make network requests to internal services or cloud metadata endpoints that are not intended to be accessible. This may lead to exposure of sensitive internal resources. The vulnerability does not impact integrity or availability but has a high confidentiality impact. The risk is limited to users with repository administrator privileges.
Mitigation Recommendations
Red Hat has released an official fix in Red Hat Quay version 3.9.25. Users should apply this update after ensuring all prior relevant errata are applied. Additionally, network egress from Quay mirror worker pods or containers should be restricted using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Repository creation and administrator privileges should be limited to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9rpm-rwwc-xw43
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-15927"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Patch Information
Threat ID: 6a74cfb1bf8831d5391b2683
Added to database: 08/06/2026, 18:17:21 UTC
Last enriched: 08/06/2026, 19:39:46 UTC
Last updated: 08/07/2026, 02:07:39 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.