{"id":"CVE-2026-32591","aliases":["EUVD-2026-20517","GHSA-9wjq-f6rc-86wf"],"status":"published","title":"Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration","description":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.","severity":{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00337,"percentile":0.27354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-04-08T17:06:58Z","modified":"2026-11-01T04:54:11Z","products":[{"vendor":"red hat","product":"mirror registry for red hat openshift"},{"vendor":"red hat","product":"mirror registry for red hat openshift 2"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.18"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"redhat","product":"mirror_registry_for_red_hat_openshift"},{"vendor":"redhat","product":"quay"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:24833","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70267","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32591","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446965","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32591"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"url":"https://github.com/advisories/GHSA-9wjq-f6rc-86wf"}],"sources":{"cve":[{"id":"CVE-2026-32591","title":"Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration","description":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.","status":"published","published":"2026-04-08T17:06:58.222Z","modified":"2026-11-01T04:54:11.147Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918","CWE-918"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-20517","description":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.","status":"published","published":"2026-04-08T17:06:58Z","modified":"2026-11-01T04:54:11Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:58:50.118267Z"}],"ghsa":[{"id":"GHSA-9wjq-f6rc-86wf","title":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization...","description":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.","status":"published","published":"2026-04-08T18:34:08Z","modified":"2026-09-22T18:34:07Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:12:17.909941Z"}],"nvd":[{"id":"CVE-2026-32591","description":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.","status":"published","published":"2026-04-08T18:26:00.107Z","modified":"2026-09-22T18:17:13.84Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:13.535987Z"}]}}