This vulnerability in Red Hat Quay's repository-level mirror configuration feature allows SSRF due to missing validation on the external_reference parameter in POST and PUT handlers within endpoints/api/mirror.py. Unlike organization-level mirror handlers that apply validate_external_registry_url(), the repository-level handlers do not validate the external_reference parameter, enabling a repository administrator to cause the Quay mirror worker to issue requests via Skopeo to internal or otherwise restricted network resources. This can lead to unauthorized access to internal services or cloud metadata endpoints.

An attacker with repository administrator privileges can exploit this SSRF vulnerability to make the Quay mirror worker send requests to internal network services, cloud metadata endpoints, or other restricted resources that are not intended to be accessible from the Quay application. This could lead to unauthorized information disclosure or other impacts related to accessing internal resources. The CVSS score is 6.8 (medium severity) with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-15927 for current remediation guidance. No official fix or temporary workaround is stated in the provided data. Until a patch is available, restrict repository administrator privileges to trusted users only and monitor for unusual mirror configuration changes.