CVE-2026-32591

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Apr 8, 2026
Source updated: Sep 22, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat Quay 3.10

Vendor: Red Hat
Product: Red Hat Quay 3.10
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.10 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1783750447	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.12

Vendor: Red Hat
Product: Red Hat Quay 3.12
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.12 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1783751865	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.12

Vendor: Red Hat
Product: Red Hat Quay 3.12
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.12 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1784353904	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.14

Vendor: Red Hat
Product: Red Hat Quay 3.14
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.14 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1788593843	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.15

Vendor: Red Hat
Product: Red Hat Quay 3.15
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.15 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1784351966	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.16

Vendor: Red Hat
Product: Red Hat Quay 3.16
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.16 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1783955846	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.17

Vendor: Red Hat
Product: Red Hat Quay 3.17
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1780604033	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.18

Vendor: Red Hat
Product: Red Hat Quay 3.18
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.18 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1784987273	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Quay 3.9

Vendor: Red Hat
Product: Red Hat Quay 3.9
Platforms: Unknown
Default status: affected
Package: quay/quay-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Quay 3.9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1784125838	`unaffected`	rpm	*	Unavailable	None listed

mirror registry for Red Hat OpenShift

Vendor: Red Hat
Product: mirror registry for Red Hat OpenShift
Platforms: Unknown
Default status: affected
Package: openshift/mirror-registry-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

mirror registry for Red Hat OpenShift 2

Vendor: Red Hat
Product: mirror registry for Red Hat OpenShift 2
Platforms: Unknown
Default status: affected
Package: openshift/mirror-registry-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.