{"id":"CVE-2026-15927","aliases":["EUVD-2026-46150","GHSA-9rpm-rwwc-xw43"],"status":"published","title":"Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation","description":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00604,"percentile":0.49181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-07-21T04:45:27Z","modified":"2026-11-01T04:52:14Z","products":[{"vendor":"red hat","product":"mirror registry for red hat openshift 2"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50931","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52968","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54395","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63307","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69255","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70267","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15927","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501256","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15927"},{"url":"https://github.com/advisories/GHSA-9rpm-rwwc-xw43"}],"sources":{"cve":[{"id":"CVE-2026-15927","title":"Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation","description":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.","status":"published","published":"2026-07-21T04:45:27.751Z","modified":"2026-11-01T04:52:14.759Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-46150","description":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.","status":"published","published":"2026-07-21T04:45:27Z","modified":"2026-11-01T04:52:14Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:58:50.118267Z"}],"ghsa":[{"id":"GHSA-9rpm-rwwc-xw43","title":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and...","description":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.","status":"published","published":"2026-07-21T06:31:18Z","modified":"2026-09-22T18:34:11Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:12:17.909941Z"}],"nvd":[{"id":"CVE-2026-15927","description":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.","status":"published","published":"2026-07-21T06:16:28.603Z","modified":"2026-09-22T18:17:10.97Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:31.024898Z"}]}}