CVE-2026-15927: Red Hat Mirror Registry For Red Hat Openshift 2

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Affected products

• Red Hat Mirror Registry For Red Hat Openshift 2
• Red Hat Red Hat Quay 3.10: before 1786395065 (fixed in 1786395065)
• Red Hat Red Hat Quay 3.12: before 1786170635 (fixed in 1786170635)
• Red Hat Red Hat Quay 3.14: before 1788593843 (fixed in 1788593843)
• Red Hat Red Hat Quay 3.15: before 1788191755 (fixed in 1788191755)
• Red Hat Red Hat Quay 3.16: before 1789563753 (fixed in 1789563753)
• Red Hat Red Hat Quay 3.17: before 1786181981 (fixed in 1786181981)
• Red Hat Red Hat Quay 3.9: before 1785950004 (fixed in 1785950004)

Published 2026-07-21. Last modified 2026-09-22.