REDHAT-BUG-2501256: SSRF

Published Jul 16, 2026

Updated

A Server-Side Request Forgery (SSRF) vulnerability was identified in Red Hat Quay's repository-level mirror configuration feature. An authenticated repository administrator can supply an attacker-controlled hostname as the externalreference parameter when enabling or updating repository mirroring via endpoints/api/mirror.py (POST and PUT handlers). The value is stored without SSRF validation and later interpolated into a docker:// URL that Skopeo uses for HTTP requests, allowing the attacker to force the Quay mirror worker to connect to internal services.

Affected Software

1 affected component

Red Hat Quay

Event History

Jul 16, 2026

Data Sourced

via Red Hat·07:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2501256?

The severity of REDHAT-BUG-2501256 is rated high with a score of 7.

How do I fix REDHAT-BUG-2501256?

To fix REDHAT-BUG-2501256, administrators should ensure proper validation of the external_reference parameter before enabling or updating repository mirroring.

What type of vulnerability is REDHAT-BUG-2501256?

REDHAT-BUG-2501256 is a Server-Side Request Forgery (SSRF) vulnerability.

Who is affected by REDHAT-BUG-2501256?

Authenticated repository administrators of Red Hat Quay are affected by REDHAT-BUG-2501256.

When was REDHAT-BUG-2501256 published?

REDHAT-BUG-2501256 was published on July 16, 2026.