Executive brief
Red Hat mirror-registry and Quay are tools used to manage and mirror container images within enterprise environments. A security flaw allows an authenticated user to provide a malicious web address that tricks the system into connecting to internal or restricted servers it should not access. This could lead to the exposure of sensitive internal data or unauthorized access to private network resources.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat mirror-registry and Quay, specifically within the organization mirroring API and log export callback functionality. The application fails to properly validate user-supplied URLs and automatically follows redirects without verifying the final destination. An authenticated attacker can provide a malicious URL that, when processed by a backend worker, routes requests to internal or restricted systems (such as cloud metadata services or private network IPs). The fix involves implementing DNS-resolved validation against private/reserved IP ranges and introducing an allowlist configuration (SSRF_ALLOWED_HOSTS).
Affected products
- Red Hat mirror-registry unspecified
- Red Hat Quay 3.0.0
Timeline
- 2026-02-11: disclosed: Initial report in Red Hat Bugzilla
- 2026-02-16: patched: Fix merged in Quay GitHub repository
- 2026-03-12: advisory: NVD and Red Hat published advisory