Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
Priority LOW 31CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Quay 3.10 | — | 1786395065 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.12 | — | 1786170635 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.14 | — | 1788593843 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.15 | — | 1788191755 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.16 | — | 1789563753 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.17 | — | 1786181981 | Patch available | CNA |
| Red Hat | Red Hat Quay 3.9 | — | 1785950004 | Patch available | CNA |
| Red Hat | mirror registry for Red Hat OpenShift 2 | — | — | No fix listed | CNA |
- Red Hat Quay 3.10 VendorRed Hat Affected — Fixed in 1786395065 Patch available CNA
- Red Hat Quay 3.12 VendorRed Hat Affected — Fixed in 1786170635 Patch available CNA
- Red Hat Quay 3.14 VendorRed Hat Affected — Fixed in 1788593843 Patch available CNA
- Red Hat Quay 3.15 VendorRed Hat Affected — Fixed in 1788191755 Patch available CNA
- Red Hat Quay 3.16 VendorRed Hat Affected — Fixed in 1789563753 Patch available CNA
- Red Hat Quay 3.17 VendorRed Hat Affected — Fixed in 1786181981 Patch available CNA
- Red Hat Quay 3.9 VendorRed Hat Affected — Fixed in 1785950004 Patch available CNA
- mirror registry for Red Hat OpenShift 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:quay:3.10::el8 | 3.10 | — | Red Hat |
| cpe:/a:redhat:quay:3.12::el8 | 3.12 | — | Red Hat |
| cpe:/a:redhat:quay:3.14::el8 | 3.14 | — | Red Hat |
| cpe:/a:redhat:quay:3.15::el8 | 3.15 | — | Red Hat |
| cpe:/a:redhat:quay:3.16::el9 | 3.16 | — | Red Hat |
| cpe:/a:redhat:quay:3.17::el9 | 3.17 | — | Red Hat |
| cpe:/a:redhat:quay:3.9::el8 | 3.9 | — | Red Hat |
| cpe:/a:redhat:mirror_registry:2 | 2 | — | Red Hat |
- cpe:/a:redhat:quay:3.10::el8 Versions 3.10 — ·Red Hat
- cpe:/a:redhat:quay:3.12::el8 Versions 3.12 — ·Red Hat
- cpe:/a:redhat:quay:3.14::el8 Versions 3.14 — ·Red Hat
- cpe:/a:redhat:quay:3.15::el8 Versions 3.15 — ·Red Hat
- cpe:/a:redhat:quay:3.16::el9 Versions 3.16 — ·Red Hat
- cpe:/a:redhat:quay:3.17::el9 Versions 3.17 — ·Red Hat
- cpe:/a:redhat:quay:3.9::el8 Versions 3.9 — ·Red Hat
- cpe:/a:redhat:mirror_registry:2 Versions 2 — ·Red Hat
Remediation
Red Hat 7 advisories
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:69255 Released 2026-09-21 · Red Hat rating ImportantRed Hat Quay 3.16.6
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:63307 Released 2026-09-03 · Red Hat rating ImportantRed Hat Quay 3.15.8
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
Show 4 more Red Hat advisories
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:53520 Released 2026-08-11 · Red Hat rating ImportantRed Hat Quay 3.10.25
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:52968 Released 2026-08-10 · Red Hat rating ImportantRed Hat Quay 3.12.21
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:50931 Released 2026-08-05 · Red Hat rating ImportantRed Hat Quay 3.9.25
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| mirror registry for Red Hat OpenShift 2 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:53520 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:52968 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:63307 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:69255 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:50931 |
Not affected: 7 products
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15927
- 2026-10-03 Alias added: GHSA-9rpm-rwwc-xw43
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-15927 · CVE Program
- CVE-2026-15927 · NVD
- FIRST EPSS
- GHSA-9rpm-rwwc-xw43 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-15927 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences