Skip to content
Fencer Vulns
medium 6.8

CVE-2026-15927 json

Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

published 2026-07-21 3 mo ago modified 2026-11-01 8 d ago also EUVD-2026-46150

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Patch / fix

  • Red Hat Red Hat Quay 3.10 1786395065
  • Red Hat Red Hat Quay 3.12 1786170635
  • Red Hat Red Hat Quay 3.14 1788593843
  • Red Hat Red Hat Quay 3.15 1788191755
  • Red Hat Red Hat Quay 3.16 1789563753
  • Red Hat Red Hat Quay 3.17 1786181981
  • Red Hat Red Hat Quay 3.9 1785950004

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15927 updated cvss 6.8

quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation

  • Red Hat mirror registry for Red Hat OpenShift 2 openshift/mirror-registry-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3.9 quay/quay-rhel8 1785950004
    fixed: vendor fix RHSA-2026:50931
  • Red Hat Quay 3.10 quay/quay-rhel8 1786395065
    fixed: vendor fix RHSA-2026:53520
  • Red Hat Quay 3.12 quay/quay-rhel8 1786170635
    fixed: vendor fix RHSA-2026:52968
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1786181981
    fixed: vendor fix RHSA-2026:54395
show 1 more
  • Red Hat Quay 3.9 quay/clair-rhel8 1785563558, quay/quay-builder-rhel8 1785563573, quay/quay-operator-rhel8 1785563557, quay/quay-operator-bundle 1785954125, quay/quay-bridge-operator-rhel8 1785563571, quay/quay-bridge-operator-bundle 1785564443, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1786394800, quay/quay-builder-rhel8 1786394811, quay/quay-operator-rhel8 1786394797, quay/quay-operator-bundle 1786398374, quay/quay-bridge-operator-rhel8 1786394781, quay/quay-bridge-operator-bundle 1786395288, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1786170209, quay/quay-builder-rhel8 1786170241, quay/quay-operator-rhel8 1786170245, quay/quay-operator-bundle 1786174731, quay/quay-bridge-operator-rhel8 1786170019, quay/quay-bridge-operator-bundle 1786171106, +3 more Red Hat Quay 3.14 quay/clair-rhel8 1788593782, quay/quay-builder-rhel8 1788593707, quay/quay-operator-rhel8 1788593658, quay/quay-operator-bundle 1788598271, quay/quay-bridge-operator-rhel8 1788594258, quay/quay-bridge-operator-bundle 1788595604, +3 more Red Hat Quay 3.15 quay/clair-rhel8 1787986213, quay/quay-builder-rhel8 1787824210, quay/quay-operator-rhel8 1787987657, quay/quay-operator-bundle 1788196149, quay/quay-bridge-operator-rhel8 1787986808, quay/quay-bridge-operator-bundle 1787987365, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1789191202, quay/quay-builder-rhel9 1789492236, quay/quay-operator-rhel9 1789190909, quay/quay-operator-bundle 1789627085, quay/quay-bridge-operator-rhel9 1789191073, quay/quay-bridge-operator-bundle 1789191920, +3 more
    +1 more products
    Red Hat Quay 3.17 quay/clair-rhel9 1786181669, quay/quay-builder-rhel9 1786181688, quay/quay-operator-rhel9 1786181701, quay/quay-operator-bundle 1786429805, quay/quay-bridge-operator-rhel9 1786181654, quay/quay-bridge-operator-bundle 1786182526, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.9
  • Red Hat mirror registry for Red Hat OpenShift 2

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.