Описание
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Отчет
This Important flaw in Red Hat Quay's repository-level mirror configuration allows an authenticated repository administrator to conduct Server-Side Request Forgery (SSRF). By providing a specially crafted hostname, an attacker can force the Quay mirror worker to connect to internal network services or cloud metadata endpoints, potentially exposing sensitive internal resources. This risk is limited to actions performed by an authenticated administrator.
Меры по смягчению последствий
Restrict network egress from Quay mirror worker pods/containers using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Limit repository creation and admin privileges to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| mirror registry for Red Hat OpenShift 2 | openshift/mirror-registry-rhel8 | Will not fix | ||
| Red Hat Quay 3.1 | quay/quay-rhel8 | Fixed | RHSA-2026:53520 | 11.08.2026 |
| Red Hat Quay 3.12 | quay/quay-rhel8 | Fixed | RHSA-2026:52968 | 10.08.2026 |
| Red Hat Quay 3.17 | quay/quay-rhel9 | Fixed | RHSA-2026:54395 | 12.08.2026 |
| Red Hat Quay 3.9 | quay/quay-rhel8 | Fixed | RHSA-2026:50931 | 05.08.2026 |
Показывать по
Дополнительная информация
Статус:
6.8 Medium
CVSS3
Связанные уязвимости
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
6.8 Medium
CVSS3