CVE-2026-32591 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Quay's Proxy Cache configuration. When an organization administrator sets an upstream registry hostname, Quay does not verify if the hostname points to a legitimate external service. This allows an attacker with organization administrator privileges to supply a crafted hostname that causes the Quay server to make network requests to internal network services, cloud infrastructure endpoints, or other unauthorized resources. The vulnerability affects versions prior to 3.17.3. Red Hat has published advisories and released Red Hat Quay 3.17.3 with fixes for this issue.

An attacker with organization administrator privileges can exploit this vulnerability to make the Quay server perform unauthorized network requests to internal or cloud infrastructure endpoints. This could lead to unauthorized access or information disclosure from internal services that should not be accessible via the Quay application. The CVSS score of 5.2 reflects a medium severity impact with high confidentiality impact, low integrity impact, and no availability impact.

Red Hat has released Red Hat Quay version 3.17.3 which addresses this SSRF vulnerability. Users should upgrade to version 3.17.3 or later to remediate this issue. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/errata/RHSA-2026:24833 and https://access.redhat.com/articles/11258 for detailed guidance.