CVE-2026-32591Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

Description

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

Timeline

Scores

EPSS (exploitation in 30 days)

0.35% · top 71% of all CVEs (15 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.2.

Affected products

• Red Hat · Red Hat Quay 3.10

  • unaffected 1783750447 – < *

• Red Hat · Red Hat Quay 3.12

  • unaffected 1783751865 – < *

• Red Hat · Red Hat Quay 3.12

  • unaffected 1784353904 – < *

• Red Hat · Red Hat Quay 3.14

  • unaffected 1788593843 – < *

• Red Hat · Red Hat Quay 3.15

  • unaffected 1784351966 – < *

• Red Hat · Red Hat Quay 3.16

  • unaffected 1783955846 – < *

• Red Hat · Red Hat Quay 3.17

  • unaffected 1780604033 – < *

• Red Hat · Red Hat Quay 3.17

  • unaffected 1793993778 – < *

• Red Hat · Red Hat Quay 3.18

  • unaffected 1784987273 – < *

• Red Hat · Red Hat Quay 3.9

  • unaffected 1784125838 – < *

• Red Hat · mirror registry for Red Hat OpenShift

  All versions: affected

• Red Hat · mirror registry for Red Hat OpenShift 2

  All versions: affected

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-20517 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-32591](https://cveledger.app/badge/CVE-2026-32591.svg)](https://cveledger.app/cve/CVE-2026-32591)

Record last updated 12 Nov 2026, 23:43 UTC.