What is the CVSS score of CVE-2026-15927?

CVE-2026-15927 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Red Hat Quay CVE-2026-15927

EUVD-2026-46150 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-21 redhat

GHSA-9rpm-rwwc-xw43

SSRF Red Hat Mirror Registry For Red Hat Openshift 2 Red Hat Quay 3 Red Hat

6.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

PR:H confirmed by repository-admin-only access; S:C and C:H reflect SSRF reaching confidential internal services beyond Quay's own boundary; no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

6.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 06:01 vuln.today

DescriptionCVE.org

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

AnalysisAI

Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.

Technical ContextAI

Red Hat Quay is an enterprise container image registry; its mirroring subsystem periodically syncs images from upstream registries by spawning Skopeo, a command-line container image utility. Mirror sources are configured via POST and PUT requests to endpoints/api/mirror.py, which accept an external_reference field identifying the upstream registry/repository URI. Organization-level mirror handlers call validate_external_registry_url() to reject non-routable or internal destinations, but the repository-level handlers omit this call entirely, meaning Skopeo is invoked with an attacker-supplied hostname. CWE-918 (Server-Side Request Forgery) is the exact root cause: user-controlled input reaches an outbound HTTP/network request without allowlist or destination validation. Affected products are confirmed by CPE cpe:2.3:a:red_hat:red_hat_quay_3:*:*:*:*:*:*:*:* and cpe:2.3:a:red_hat:mirror_registry_for_red_hat_openshift_2:*:*:*:*:*:*:*:*.

RemediationAI

Apply the Red Hat-issued patch for CVE-2026-15927 as soon as it is released; monitor https://access.redhat.com/security/cve/CVE-2026-15927 for the specific fixed package version, which has not been confirmed in current data. As an immediate compensating control, enforce strict egress network policy on the host or pod running the Quay mirror worker, blocking outbound connections to cloud metadata addresses (169.254.169.254, fd00:ec2::254) and RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); note that overly broad egress blocking may disrupt legitimate mirroring from external registries, so an allowlist approach targeting known registry hostnames is preferable. Additionally, audit and restrict repository administrator grants to the minimum set of trusted principals, as the vulnerability is only exploitable by users holding that role - reducing the pool of potential abusers lowers effective risk immediately without requiring a code change.