VDB

CVE-2026-15927

CVE-2026-15927 PUBLISHED CVSS 6.8 MEDIUM

Reported by redhat · Published July 21, 2026

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Risk Scores

CVSS 3.1
6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Quay 3.101786395065
Red HatRed Hat Quay 3.121786170635
Red HatRed Hat Quay 3.141788593843
Red HatRed Hat Quay 3.151788191755
Red HatRed Hat Quay 3.161789563753
Red HatRed Hat Quay 3.171786181981
Red HatRed Hat Quay 3.91785950004
Red Hatmirror registry for Red Hat OpenShift 2
Red HatRed Hat Quay 3.171786181981, 1786181981, 1786181981
Red HatRed Hat Quay 3.141788593843
Red HatRed Hat Quay 3.91785950004, 1785950004, 1785950004
Red HatRed Hat Quay 3.121786170635, 1786170635, 1786170635
Red HatRed Hat Quay 3
Red HatRed Hat Quay 3.11786395065, 1786395065, 1786395065
Red HatRed Hat Quay 3.151788191755, 1788191755, 1788191755
Red Hatmirror registry for Red Hat OpenShift 2
Red HatRed Hat Quay 3.101786395065, 1786395065, 1786395065
Red HatRed Hat Quay 3.161789563753, 1789563753
Red HatRed Hat Quay 3

Timeline

  • Jul 21, 2026 EPSS Score
  • Jul 21, 2026 Coalition ESS Score
  • Jul 21, 2026 CVE Published
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›