Executive brief
Red Hat Quay, a container image registry, contains a security flaw in its repository mirroring feature. An authorized repository administrator can trick the system into making unauthorized network requests to internal services or cloud metadata endpoints that should be private. This could allow an attacker to gather sensitive information about the internal network or cloud environment where the registry is hosted.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat Quay's repository-level mirror configuration. The POST and PUT handlers in 'endpoints/api/mirror.py' fail to validate the 'external_reference' parameter, unlike the organization-level handlers which utilize 'validate_external_registry_url()'. An authenticated repository administrator can provide a malicious hostname that is subsequently used by the Quay mirror worker via Skopeo. This allows the attacker to force the worker to make requests to internal network services or cloud metadata endpoints (e.g., IMDS). The vulnerability is tracked as CWE-918.
Affected products
- Red Hat Red Hat Quay 3 3
- Red Hat mirror registry for Red Hat OpenShift 2 2
Timeline
- 2026-07-16: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date