EUVD-2026-20517
GHSA-9wjq-f6rc-86wf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 5.2 score reflects moderate severity with high confidentiality impact (C:H) but lower integrity (I:L) and no availability impact (A:N). The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U) indicates this is a network-accessible vulnerability with low attack complexity, yet the high privilege requirement (administrator role) and user interaction requirement (administrator must manually configure the hostname) significantly constrain real-world exploitability. From a SSVC perspective, the technical impact is substantial-attackers can access internal services and exfiltrate sensitive data from restricted network zones-but the attack surface is limited to malicious administrators or administrators who can be socially engineered. The absence of public exploit code and lack of KEV/active exploitation status suggest this is not yet a widespread threat despite the high-confidence nature of SSRF vulnerabilities. Organizations with strong administrative access controls and change approval processes face lower risk than those with permissive administrator roles or inadequate segregation of duties. This is a credible priority for environments where untrusted parties may gain administrator credentials or where cloud deployments expose sensitive metadata endpoints. |
| Exploit ScenarioDerived | A malicious or compromised organization administrator in a Quay deployment configures an upstream registry hostname pointing to the internal Kubernetes API server (e.g., 'kubernetes.default.svc.cluster.local') or an AWS EC2 metadata endpoint (169.254.169.254). Quay establishes a connection to retrieve registry metadata without validating the destination, allowing the attacker to exfiltrate internal service responses, enumerate cluster configuration, or extract cloud credentials. The attack requires the administrator role and manual configuration but can be chained with container image pull operations to exploit the exposed internal services. No public proof-of-concept code has been disclosed, but SSRF vulnerabilities of this class are straightforward to exploit once administrative access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization administrators to force the Quay server to make unvalidated network requests to internal services, cloud infrastructure endpoints, or otherwise restricted resources by supplying a crafted upstream registry hostname. With CVSS 5.2 and high confidentiality impact, this vulnerability requires administrator privileges and user interaction but poses significant risk to internal network exposure; no public exploit code or active exploitation (KEV) confirmed at time of analysis.
RemediationAI
Organizations must upgrade Red Hat Quay to a patched version released after this advisory (consult https://access.redhat.com/security/cve/CVE-2026-32591 and https://bugzilla.redhat.com/show_bug.cgi?id=2446965 for exact version numbers and timelines). For Mirror Registry for Red Hat OpenShift, ensure both 1.x and 2.x deployments are updated to their respective patched releases. As a short-term compensating control, restrict the ability to configure Proxy Cache settings to a minimal set of highly trusted administrators, enforce mandatory change approval workflows for upstream registry hostname modifications, and implement network segmentation to limit Quay server access to only approved external registries. Monitor and audit all Proxy Cache configuration changes and validate that configured upstream registries resolve to legitimate external services. Container image registries should implement egress firewall rules to prevent Quay from accessing internal network ranges (RFC 1918) and cloud metadata endpoints (169.254.169.254, etc.).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Red Hat Quay implements a Proxy Cache feature that allows organization administrators to configure upstream registries for caching container images. The vulnerability stems from improper input validation of the upstream registry hostname (CWE-918: Server-Side Request Forgery). When a hostname is supplied, Quay establishes a network connection without verifying that the destination is a legitimate external service, enabling an attacker to redirect requests to internal IP addresses (RFC 1918 ranges), localhost services, cloud metadata endpoints (e.g., AWS IMDSv2, GCP metadata service), Kubernetes API servers, or other restricted resources. The affected products include Red Hat Quay 3.x and Mirror Registry for Red Hat OpenShift (versions 1.x and 2.x), which share this codebase. The SSRF attack vector is network-based, low complexity, but gated by high privilege (PR:H) requirement and user interaction (UI:R), indicating the vulnerability requires an administrator to actively configure the malicious upstream registry.
Know when Mirror Registry For Red Hat Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)NVD
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deser
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concur
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct
Server-side request forgery in Red Hat Quay allows an authenticated repository administrator to bypass the hostname blac
OpenShift Mirror Registry leaks valid usernames and email addresses through inconsistent error messages during authentic
Exploit-DB