CVE-2026-15927 Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
Repository administrators can exploit missing URL validation in Quay's mirror configuration to perform Server-Side Request Forgery against internal services.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15927?
CVE-2026-15927 is a medium-severity server-side request forgery vulnerability in Red Hat Quay 3.10, published on 21 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Weakness: CWE-918
Which versions are affected by CVE-2026-15927?
How do I fix CVE-2026-15927?
No fix has been published for CVE-2026-15927 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-15927 being exploited?
There is no known exploitation of CVE-2026-15927 in the wild and no public exploit code.
Sources
Also known as GHSA-9rpm-rwwc-xw43.