CVE-2026-32591
published 2026-04-08CVE-2026-32591: A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching…
PriorityP337medium5.5CVSS 3.1
AVNACLPRHUINSUCHILAN
EPSS
0.33%
25.3th percentile
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | mirror_registry_for_red_hat_openshift | — | — |
| redhat | quay | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
vendor_redhat5.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
vendor_redhat·2026-04-08·CVSS 5.2
CVE-2026-32591 [MEDIUM] CWE-918 mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
Statement: Exploitation requires the attacker to be authenticated as an organization administrator.
Package: openshift/mirror-registry-rhel8 (
VulDB
Red Hat OpenShift mirror registry server-side request forgery (EUVD-2026-20517)
vuldb·2026-07-29·CVSS 5.5
CVE-2026-32591 [MEDIUM] Red Hat OpenShift mirror registry server-side request forgery (EUVD-2026-20517)
A vulnerability classified as critical has been found in Red Hat OpenShift. This impacts an unknown function of the component mirror registry. This manipulation causes server-side request forgery.
The identification of this vulnerability is CVE-2026-32591. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
GHSA-9wjq-f6rc-86wf: A flaw was found in Red Hat Quay's Proxy Cache configuration feature
ghsa_unreviewed·2026-04-08
CVE-2026-32591 [MEDIUM] CWE-918 GHSA-9wjq-f6rc-86wf: A flaw was found in Red Hat Quay's Proxy Cache configuration feature
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85471 quay: quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable
bugzilla·2026-09-03·CVSS 5.5
CVE-2026-85471 [MEDIUM] CVE-2026-85471 quay: quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable
CVE-2026-85471 quay: quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable
## Webhook notification SSRF: hostname-string blocklist trivially bypassable
**CWEs:** CWE-918
**CVSS:** 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
**Component:** quay/quay
### Description
`HOSTNAME_BLACKLIST = ["localhost", "127.0.0.1"]` extended by `WEBHOOK_HOSTNAME_BLACKLIST` (default `[]`, `config.py:840`). `WebhookMethod.validate()` and `.perform()` test only `urlparse(url).hostname.lower() in HOSTNAME_BLACKLIST` before `requests.post(url, ...)`. No DNS resolution, no IP-range check, no use of `util/security/ssrf.py`. Any repo admin (i.e. any authenticated tenant on their own repo) can target `169.254.169.254`, `0.0.0.0`, `[::1]`, `127.0.0.2`, decimal/octal IP encodings, o
Bugzilla
CVE-2026-32591 mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
bugzilla·2026-03-12·CVSS 5.2
CVE-2026-32591 [MEDIUM] CVE-2026-32591 mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
CVE-2026-32591 mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
A Server-Side Request Forgery (SSRF) vulnerability was identified in Red Hat Quay v3.12.x within the Proxy Cache configuration feature. An authenticated organization administrator can supply an attacker-controlled hostname as the upstream_registry parameter when creating or validating a proxy cache configuration. Quay instantiates a network connection to the supplied hostname with no validation against internal address ranges, private IP space, or cloud metadata endpoints.
Requirements to exploit: Attacker needs to be logged into the web app / initiate podman execution from host.
Component affected:
Mirror Registry for OpenShift – Proxy Cache configuration feature
Quay deploy
https://access.redhat.com/errata/RHSA-2026:24833https://access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:41031https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:42146https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:43052https://access.redhat.com/errata/RHSA-2026:48085https://access.redhat.com/errata/RHSA-2026:70267https://access.redhat.com/security/cve/CVE-2026-32591https://bugzilla.redhat.com/show_bug.cgi?id=2446965https://access.redhat.com/errata/RHSA-2026:24833https://access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:41031https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:42146https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:43052https://access.redhat.com/errata/RHSA-2026:48085https://access.redhat.com/security/cve/CVE-2026-32591https://bugzilla.redhat.com/show_bug.cgi?id=2446965https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json
2026-04-08
Published