CVE-2026-15927: Red Hat Quay SSRF Vulnerability

CVE-2026-15927 Overview

CVE-2026-15927 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without applying SSRF validation. The organization-level mirror handlers correctly invoke validate_external_registry_url(), but the repository-level endpoints omit this check. A repository administrator can supply a crafted hostname that forces the Quay mirror worker to issue Skopeo requests against internal network services, cloud metadata endpoints, or other resources unreachable from outside the Quay application.

Critical Impact
Authenticated repository administrators can pivot the Quay mirror worker into internal networks and cloud metadata services, exposing confidential infrastructure data.

Affected Products

Red Hat Quay (repository-level mirror configuration feature)
Deployments exposing repository administrator privileges to tenants
Quay instances with the mirror worker enabled

Discovery Timeline

2026-07-21 - CVE CVE-2026-15927 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-15927

Vulnerability Analysis

The vulnerability resides in the repository-level mirror API endpoints exposed by Red Hat Quay. Quay accepts an external_reference parameter that instructs the mirror worker where to pull container images from. At the organization scope, Quay filters this input through validate_external_registry_url() to block private-network hostnames, loopback addresses, and cloud metadata IPs. The repository-scoped POST and PUT handlers in endpoints/api/mirror.py skip this validation entirely.

Once a mirror configuration is saved, the Quay mirror worker calls Skopeo to fetch image content from the supplied reference. Skopeo will resolve the attacker-controlled hostname and initiate HTTP or HTTPS traffic from inside the Quay trust boundary. This yields a classic blind SSRF primitive against any host reachable from the mirror worker.

Root Cause

The root cause is missing input validation at a specific API surface. The validate_external_registry_url() helper enforces allow-list logic on registry URLs, but it is not invoked from the repository-level mirror handlers. The inconsistency between organization and repository handlers left the SSRF sink exposed.

Attack Vector

An authenticated repository administrator submits a mirror configuration containing an external_reference that points to an internal IP address, a link-local address such as 169.254.169.254, or another sensitive endpoint. The Quay mirror worker then dispatches Skopeo to that host. Responses may not be returned to the attacker, but the request itself can reach IMDS endpoints, internal admin panels, or cloud orchestration APIs. See the Red Hat CVE Advisory and Red Hat Bug Report #2501256 for detailed advisory information.

Detection Methods for CVE-2026-15927

Indicators of Compromise

Mirror configurations referencing 169.254.169.254, 127.0.0.1, localhost, or RFC1918 addresses in the external_reference field.
Skopeo processes launched by the Quay mirror worker making outbound requests to internal subnets or cloud metadata endpoints.
Repeated failed mirror sync attempts against hostnames that do not resolve to public container registries.

Detection Strategies

Audit Quay API logs for POST and PUT requests to repository mirror endpoints and inspect the submitted external_reference values.
Correlate mirror worker egress traffic against an allow-list of legitimate upstream registries.
Alert on any DNS resolution or TCP connection from mirror worker pods to metadata service IP ranges.

Monitoring Recommendations

Enable database-level auditing on the repomirrorconfig table to record hostname changes.
Forward Quay application and Skopeo subprocess logs to a centralized SIEM for query and retention.
Monitor for anomalous repository administrator activity, especially newly created mirror configurations followed by immediate sync triggers.

How to Mitigate CVE-2026-15927

Immediate Actions Required

Restrict repository administrator privileges to trusted operators until a patched Quay release is deployed.
Enforce network-level egress filtering on the Quay mirror worker so it can only reach approved container registry hosts.
Block outbound traffic from mirror worker pods to cloud metadata IP ranges such as 169.254.169.254.

Patch Information

Refer to the Red Hat CVE Advisory for the current list of fixed Quay versions and associated errata. The fix aligns repository-level mirror handlers with the organization-level flow by invoking validate_external_registry_url() on the external_reference parameter.

Workarounds

Disable the repository-level mirror feature where it is not required for business operations.
Deploy an egress proxy in front of the mirror worker that enforces a domain allow-list for upstream registries.
Use instance metadata service protections such as IMDSv2 with hop-limit restrictions on AWS to blunt SSRF against cloud metadata.

bash

# Example egress restriction using iptables on the mirror worker host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP