{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15927","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-07-16T06:31:41.405Z","datePublished":"2026-07-21T04:45:27.751Z","dateUpdated":"2026-08-23T17:41:19.609Z"},"containers":{"cna":{"title":"Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation","metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Quay 3.1","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1786395065","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:quay:3.10::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.12","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1786170635","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:quay:3.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.17","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"quay/quay-rhel9","defaultStatus":"affected","versions":[{"version":"1786181981","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:quay:3.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Quay 3.9","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"quay/quay-rhel8","defaultStatus":"affected","versions":[{"version":"1785950004","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:quay:3.9::el8"]},{"vendor":"Red Hat","product":"mirror registry for Red Hat OpenShift 2","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/mirror-registry-rhel8","defaultStatus":"affected","cpes":["cpe:/a:redhat:mirror_registry:2"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50931","name":"RHSA-2026:50931","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52968","name":"RHSA-2026:52968","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53520","name":"RHSA-2026:53520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54395","name":"RHSA-2026:54395","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15927","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501256","name":"RHBZ#2501256","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-07-16T00:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-918: Server-Side Request Forgery (SSRF)","workarounds":[{"lang":"en","value":"Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay's RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy."}],"timeline":[{"lang":"en","time":"2026-02-13T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-07-16T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat)."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-08-23T17:41:19.609Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-21T13:12:11.259508Z","id":"CVE-2026-15927","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-21T14:55:42.159Z"}}]}}