Bug 2501256 (CVE-2026-15927)

Summary:	CVE-2026-15927 quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aruklets, doconnor
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-16 07:16:54 UTC

A Server-Side Request Forgery (SSRF) vulnerability was identified in Red Hat
Quay's repository-level mirror configuration feature. An authenticated
repository administrator can supply an attacker-controlled hostname as the
external_reference parameter when enabling or updating repository mirroring
via endpoints/api/mirror.py (POST and PUT handlers). The value is stored
without SSRF validation and later interpolated into a docker:// URL that
Skopeo uses for HTTP requests, allowing the attacker to force the Quay
mirror worker to connect to internal services.