Skip to content
Advisories.
Red HatCVE-2026-15927

mirror registry for Red Hat OpenShift 2: server-side request forgery

Medium6.8CVE-2026-15927 · Published Jul 21, 2026 · updated Sep 22, 2026

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Red Hat advisory

Affected versions

PackageAffectedFixed in
mirror registry for Red Hat OpenShift 2
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More Red Hat advisories

All Red Hat
Advisory
Red Hat libarchive: integer overflow
Low2.9Jul 21
Red Hat Enterprise Linux 10: information disclosure
Low3.4Jul 21
Red Hat Enterprise Linux 10: out-of-bounds read
Medium4.2Jul 21
Red Hat ansible-core: argument injection
High7.8Jul 21
Red Hat libssh. Logic errors: denial of service
Low3.1Jul 21
Red Hat libssh: use after free
Medium4.3Jul 21

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.