A vulnerability in Red Hat Quay's repository-level mirror configuration feature allows repository administrators to supply a crafted hostname that causes the Quay mirror worker to make unauthorized requests to internal network services or cloud metadata endpoints. This occurs because the POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without proper SSRF validation, unlike organization-level mirror handlers. The flaw has a CVSS score of 6.8 and is classified as medium severity.