CVE-2026-32591mediumCWE-918

Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.2epss 0.3%

exploitation probability

0.3%top 74% of all CVEs

observed exploitation

nono source reports it

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Affected products

Red Hat · mirror registry for Red Hat OpenShift Red Hat · mirror registry for Red Hat OpenShift 2 Red Hat · Red Hat Quay 3.10 Red Hat · Red Hat Quay 3.12 Red Hat · Red Hat Quay 3.15 Red Hat · Red Hat Quay 3.16 Red Hat · Red Hat Quay 3.17 Red Hat · Red Hat Quay 3.18 Red Hat · Red Hat Quay 3.9

References