CVE-2026-32591: Red Hat Quay SSRF Vulnerability

CVE-2026-32591 Overview

A Server-Side Request Forgery (SSRF) vulnerability was discovered in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

Critical Impact

Attackers with organization administrator privileges can exploit this SSRF vulnerability to access internal network services, cloud metadata endpoints, and other protected resources, potentially leading to sensitive data exposure and internal reconnaissance.

Affected Products

• Red Hat Quay (Proxy Cache feature)

Discovery Timeline

• April 8, 2026 - CVE-2026-32591 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32591

Vulnerability Analysis

This vulnerability (CWE-918) represents a classic Server-Side Request Forgery pattern where user-controlled input is used to construct network requests without proper validation. The Proxy Cache configuration feature in Red Hat Quay allows organization administrators to specify upstream registry hostnames for caching purposes. The application fails to validate that the provided hostname points to a legitimate external container registry service before initiating network connections.

When the Quay server processes proxy cache requests, it directly uses the administrator-supplied hostname to make outbound HTTP requests. This design flaw enables an attacker to redirect these server-side requests to arbitrary destinations, including internal network resources that would otherwise be inaccessible from external networks.

Root Cause

The root cause of this vulnerability lies in insufficient input validation of the upstream registry hostname parameter within the Proxy Cache configuration workflow. The application does not implement proper allowlisting of permitted hostnames, does not validate that the target resolves to a legitimate external IP address, and does not block requests to private IP ranges or cloud metadata endpoints such as 169.254.169.254.

Attack Vector

This vulnerability requires network access and is exploitable by users with organization administrator privileges within Red Hat Quay. The attack vector involves the following mechanism:

1. An attacker with organization administrator access navigates to the Proxy Cache configuration settings
2. Instead of providing a legitimate container registry hostname, the attacker supplies a crafted hostname pointing to internal infrastructure
3. The attacker can use hostnames resolving to private IP ranges (e.g., 10.x.x.x, 192.168.x.x), cloud metadata endpoints (169.254.169.254), or internal service names
4. When the Quay server attempts to proxy cache requests, it makes HTTP connections to the attacker-specified target
5. Responses from internal services may be returned to the attacker, exposing sensitive configuration data, credentials, or internal service information

The vulnerability requires user interaction (UI:R) as an administrator must configure the proxy cache settings, and the high privilege requirement limits the attack surface to compromised or malicious organization administrators.

Detection Methods for CVE-2026-32591

Indicators of Compromise

• Proxy Cache configurations pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Configuration entries targeting cloud metadata endpoints such as 169.254.169.254
• Unusual outbound connections from the Quay server to internal services
• Proxy Cache hostnames resolving to localhost or loopback addresses (127.0.0.1, ::1)

Detection Strategies

• Monitor Proxy Cache configuration changes in Quay audit logs for suspicious upstream registry hostnames
• Implement network monitoring to detect Quay server connections to internal IP ranges or metadata endpoints
• Review organization administrator activity for unusual configuration changes
• Deploy egress filtering alerts for connections from Quay servers to non-registry destinations

Monitoring Recommendations

• Enable detailed audit logging for all Proxy Cache configuration operations in Red Hat Quay
• Implement DNS query logging to identify resolution of internal hostnames from the Quay application
• Configure network-level monitoring for SSRF indicator patterns from Quay server IP addresses
• Establish baseline normal behavior for Quay proxy cache network connections

How to Mitigate CVE-2026-32591

Immediate Actions Required

• Review all existing Proxy Cache configurations for suspicious or internal hostnames
• Temporarily disable Proxy Cache functionality if not business-critical until patches are applied
• Implement network-level egress filtering to block Quay server access to internal IP ranges and metadata endpoints
• Audit organization administrator accounts and remove unnecessary privileges

Patch Information

Consult the Red Hat CVE Security Advisory for official patch information and affected version details. Additional technical details are available in the Red Hat Bugzilla Report.

Workarounds

• Implement network segmentation to restrict Quay server outbound connectivity to known container registry endpoints only
• Configure firewall rules to block Quay server access to RFC 1918 private IP ranges and cloud metadata endpoints
• Limit organization administrator privileges to trusted personnel with verified business needs
• Deploy a web application firewall or proxy to inspect and filter outbound requests from the Quay server

# Example network-level mitigation: iptables rules to block SSRF targets
# Block access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block access to private IP ranges from Quay server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Block localhost/loopback SSRF attempts
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP