{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15927", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-16T06:31:41.405Z", "datePublished": "2026-07-21T04:45:27.751Z", "dateUpdated": "2026-07-21T14:55:42.159Z"}, "containers": {"cna": {"title": "Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application."}], "affected": [{"vendor": "Red Hat", "product": "mirror registry for Red Hat OpenShift 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/mirror-registry-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:mirror_registry:2"]}, {"vendor": "Red Hat", "product": "Red Hat Quay 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quay/quay-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quay:3"]}, {"vendor": "Red Hat", "product": "Red Hat Quay 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quay/quay-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quay:3"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-15927", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256", "name": "RHBZ#2501256", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-16T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)", "workarounds": [{"lang": "en", "value": "Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay's RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy."}], "timeline": [{"lang": "en", "time": "2026-02-13T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-16T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T04:45:27.751Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T13:12:11.259508Z", "id": "CVE-2026-15927", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T14:55:42.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T13:12:11.259508Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T13:12:16.167Z"}}], "cna": {"title": "Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation", "credits": [{"lang": "en", "value": "This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat)."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:mirror_registry:2"], "vendor": "Red Hat", "product": "mirror registry for Red Hat OpenShift 2", "packageName": "openshift/mirror-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quay:3"], "vendor": "Red Hat", "product": "Red Hat Quay 3", "packageName": "quay/quay-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quay:3"], "vendor": "Red Hat", "product": "Red Hat Quay 3", "packageName": "quay/quay-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-13T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-16T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-07-16T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-15927", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256", "name": "RHBZ#2501256", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay's RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T04:45:27.751Z"}, "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)"}}, "cveMetadata": {"cveId": "CVE-2026-15927", "state": "PUBLISHED", "dateUpdated": "2026-07-21T14:55:42.159Z", "dateReserved": "2026-07-16T06:31:41.405Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-07-21T04:45:27.751Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{}

{"acknowledgement": "This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat).", "bugzilla": {"description": "quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation", "id": "2501256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application."], "mitigation": {"lang": "en:us", "value": "Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay's RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy."}, "name": "CVE-2026-15927", "package_state": [{"cpe": "cpe:/a:redhat:mirror_registry:2", "fix_state": "Affected", "package_name": "openshift/mirror-registry-rhel8", "product_name": "mirror registry for Red Hat OpenShift 2"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}], "public_date": "2026-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15927\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15927"], "statement": "This Important flaw in Red Hat Quay's repository-level mirror configuration allows an authenticated repository administrator to conduct Server-Side Request Forgery (SSRF). By providing a specially crafted hostname, an attacker can force the Quay mirror worker to connect to internal network services or cloud metadata endpoints, potentially exposing sensitive internal resources. This risk is limited to actions performed by an authenticated administrator.", "threat_severity": "Important"}

{}