CVE-2026-15927: Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Other sources
A Server-Side Request Forgery (SSRF) vulnerability was identified in Red Hat Quay's repository-level mirror configuration feature. An authenticated repository administrator can supply an attacker-controlled hostname as the externalreference parameter when enabling or updating repository mirroring via endpoints/api/mirror.py (POST and PUT handlers). The value is stored without SSRF validation and later interpolated into a docker:// URL that Skopeo uses for HTTP requests, allowing the attacker to force the Quay mirror worker to connect to internal services.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15927?
The severity of CVE-2026-15927 is medium with a score of 6.8.
How does CVE-2026-15927 impact Red Hat Quay?
CVE-2026-15927 allows an SSRF attack due to the lack of URL validation for the external_reference parameter in repository-level mirror configuration.
How do I fix CVE-2026-15927?
To fix CVE-2026-15927, ensure that you apply SSRF validation to the external_reference parameter in the relevant API handlers.
What kind of vulnerability is CVE-2026-15927 classified as?
CVE-2026-15927 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Which version of Red Hat Quay is affected by CVE-2026-15927?
CVE-2026-15927 affects certain versions of Red Hat Quay that utilize the repository-level mirror configuration feature.