{"id":"CVE-2026-32591","title":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature","summary":"A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verify…","severity":"medium","cvss":5.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-918"],"vendor":"redhat","product":"mirror_registry_for_red_hat_openshift","affected":["mirror_registry_for_red_hat_openshift","mirror_registry_for_red_hat_openshift = 2.0","quay = 3.0.0"],"patched":["quay 3.10","quay 3.12","quay 3.15","quay 3.16","quay 3.17","quay 3.18","quay 3.9"],"published":"2026-04-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:18:11.060","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32591","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:24833","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32591","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446965","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:24833","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32591","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446965","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32591"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32591"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-04-10T20:34:13.210994Z"},"epss":0.00325,"epssPercentile":0.25712,"ingestedAt":"2026-07-16T02:48:54.814Z","slug":"CVE-2026-32591","body":"## Overview\n\nA flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.\n\n## Affected\n\n- `mirror_registry_for_red_hat_openshift`\n- `mirror_registry_for_red_hat_openshift = 2.0`\n- `quay = 3.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:41031** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41031)\n- **RHSA-2026:42146** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42146)\n- **RHSA-2026:43052** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43052)\n- **RHSA-2026:42796** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42796)\n- **RHSA-2026:41066** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41066)\n- **RHSA-2026:24833** · Red Hat · fixed in: Red Hat Quay 3.17 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24833)\n- **RHSA-2026:48085** · Red Hat · fixed in: Red Hat Quay 3.18 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48085)\n- **RHSA-2026:40262** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40262)\n- **Red Hat VEX** · Important · affected: mirror registry for Red Hat OpenShift, mirror registry for Red Hat OpenShift 2 · no fix planned: mirror registry for Red Hat OpenShift 2, mirror registry for Red Hat OpenShift · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":28.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}