CVE-2026-15927

MediumCVSS 6.8/10Last modified Sep 22, 2026

Description

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 21, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-159288.2XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page comp CVE-2026-159297.1Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL I CVE-2026-15939.8A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2026-159309.4The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the return CVE-2026-159316.1The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment appro CVE-2026-159325.3The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing una CVE-2026-159336.9OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously conf CVE-2026-159375.3Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS cer CVE-2026-159392.7The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does CVE-2026-15949.8A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionali CVE-2026-159416.5The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress da CVE-2026-159435.5A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a de