Skip to content
Fencer Vulns
medium 5.2

CVE-2026-32591 json

Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

published 2026-04-08 7 mo ago modified 2026-11-01 8 d ago also EUVD-2026-20517

cvss
5.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

Patch / fix

  • Red Hat Red Hat Quay 3.10 1783750447
  • Red Hat Red Hat Quay 3.12 1783751865, 1784353904
  • Red Hat Red Hat Quay 3.14 1788593843
  • Red Hat Red Hat Quay 3.15 1784351966
  • Red Hat Red Hat Quay 3.16 1783955846
  • Red Hat Red Hat Quay 3.17 1780604033
  • Red Hat Red Hat Quay 3.18 1784987273
  • Red Hat Red Hat Quay 3.9 1784125838

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32591 updated cvss 5.2

mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

  • Red Hat mirror registry for Red Hat OpenShift openshift/mirror-registry-rhel8
    affected: no fix available
  • Red Hat mirror registry for Red Hat OpenShift 2 openshift/mirror-registry-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Quay 3.9 quay/quay-rhel8 1784125838
    fixed: vendor fix RHSA-2026:40262
  • Red Hat Quay 3.10 quay/quay-rhel8 1783750447
    fixed: vendor fix RHSA-2026:41031
  • Red Hat Quay 3.12 quay/quay-rhel8 1783751865, quay/quay-rhel8 1784353904
    fixed: vendor fix RHSA-2026:42146
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1784351966
    fixed: vendor fix RHSA-2026:42796
  • Red Hat Quay 3.16 quay/quay-rhel9 1783955846
    fixed: vendor fix RHSA-2026:41066
show 3 more
  • Red Hat Quay 3.17 quay/quay-rhel9 1780604033
    fixed: vendor fix RHSA-2026:24833
  • Red Hat Quay 3.18 quay/quay-rhel9 1784987273
    fixed: vendor fix RHSA-2026:48085
  • Red Hat Quay 3.9 quay/clair-rhel8 1783747905, quay/quay-builder-rhel8 1783747952, quay/quay-operator-rhel8 1783748131, quay/quay-operator-bundle 1784129592, quay/quay-bridge-operator-rhel8 1783748068, quay/quay-bridge-operator-bundle 1783749906, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1783749793, quay/quay-builder-rhel8 1783750044, quay/quay-operator-rhel8 1783750939, quay/quay-operator-bundle 1783754116, quay/quay-bridge-operator-rhel8 1783749646, quay/quay-bridge-operator-bundle 1783750752, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1783750391, quay/clair-rhel8 1784353287, quay/quay-builder-rhel8 1783750888, quay/quay-builder-rhel8 1784353436, quay/quay-operator-rhel8 1783751561, quay/quay-operator-rhel8 1784354521, +12 more Red Hat Quay 3.14 quay/clair-rhel8 1788593782, quay/quay-builder-rhel8 1788593707, quay/quay-operator-rhel8 1788593658, quay/quay-operator-bundle 1788598271, quay/quay-bridge-operator-rhel8 1788594258, quay/quay-bridge-operator-bundle 1788595604, +3 more Red Hat Quay 3.15 quay/clair-rhel8 1784351652, quay/quay-builder-rhel8 1784351680, quay/quay-operator-rhel8 1784351641, quay/quay-operator-bundle 1784356254, quay/quay-bridge-operator-rhel8 1784351655, quay/quay-bridge-operator-bundle 1784352589, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1783749100, quay/quay-builder-rhel9 1783748231, quay/quay-operator-rhel9 1783748063, quay/quay-operator-bundle 1783961339, quay/quay-bridge-operator-rhel9 1783748414, quay/quay-bridge-operator-bundle 1783749615, +3 more
    +2 more products
    Red Hat Quay 3.17 quay/clair-rhel9 1780508896, quay/quay-builder-rhel9 1780603696, quay/quay-operator-rhel9 1780949117, quay/quay-operator-bundle 1780949884, quay/quay-bridge-operator-rhel9 1780949101, quay/quay-bridge-operator-bundle 1780949772, +3 more Red Hat Quay 3.18 quay/clair-rhel9 1784986949, quay/quay-builder-rhel9 1784986989, quay/quay-operator-rhel9 1784986977, quay/quay-operator-bundle 1785155359, quay/quay-bridge-operator-rhel9 1784987002, quay/quay-bridge-operator-bundle 1785239883, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
CISA ADP 3.1 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
NVD 3.1 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Affected products

  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.18
  • Red Hat Red Hat Quay 3.9
  • Red Hat mirror registry for Red Hat OpenShift
  • Red Hat mirror registry for Red Hat OpenShift 2

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.