CVE-2026-15927 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay prior to version 3.9.25. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without proper SSRF validation, unlike organization-level mirror handlers which apply validation. This allows a repository administrator to craft hostnames that cause the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other unintended resources. The vulnerability requires authenticated repository administrator privileges and can expose sensitive internal resources. The CVSS v3.1 base score is 6.8 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and high confidentiality impact. Red Hat has released Quay version 3.9.25 with fixes for this vulnerability.

An authenticated repository administrator can exploit this SSRF vulnerability to cause the Quay mirror worker to connect to internal network services or cloud metadata endpoints that are not intended to be accessible. This can lead to exposure of sensitive internal resources. The vulnerability does not impact integrity or availability but has a high confidentiality impact. The risk is limited to users with repository administrator privileges.

Red Hat has released Quay version 3.9.25 which fixes this vulnerability. Users should upgrade to version 3.9.25 or later. Additional mitigations include restricting network egress from Quay mirror worker pods or containers using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Limit repository creation and administrator privileges to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to mirror API endpoints through a reverse proxy.