--- id: CVE-2026-32591 title: A flaw was found in Red Hat Quay's Proxy Cache configuration feature summary: >- A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verify… severity: medium cvss: 5.2 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N' cwe: - CWE-918 vendor: redhat product: mirror_registry_for_red_hat_openshift affected: - mirror_registry_for_red_hat_openshift - mirror_registry_for_red_hat_openshift = 2.0 - quay = 3.0.0 patched: - quay 3.10 - quay 3.12 - quay 3.15 - quay 3.16 - quay 3.17 - quay 3.18 - quay 3.9 published: '2026-04-08' updated: '2026-09-22' sourceUpdated: '2026-09-22T18:17:13.840' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32591' references: - url: 'https://access.redhat.com/errata/RHSA-2026:24833' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:40262' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:41031' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:41066' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42146' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42796' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:43052' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:48085' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:70267' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-32591' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446965' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:24833' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40262' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41031' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41066' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42146' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42796' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43052' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:48085' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-32591' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446965' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32591' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32591' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-04-10T20:34:13.210994Z' epss: 0.00325 epssPercentile: 0.25791 ingestedAt: '2026-07-16T02:48:54.814Z' --- ## Overview A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application. ## Affected - `mirror_registry_for_red_hat_openshift` - `mirror_registry_for_red_hat_openshift = 2.0` - `quay = 3.0.0` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:41031** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41031) - **RHSA-2026:42146** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42146) - **RHSA-2026:43052** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43052) - **RHSA-2026:42796** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42796) - **RHSA-2026:41066** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41066) - **RHSA-2026:24833** · Red Hat · fixed in: Red Hat Quay 3.17 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24833) - **RHSA-2026:48085** · Red Hat · fixed in: Red Hat Quay 3.18 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48085) - **RHSA-2026:40262** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40262) - **Red Hat VEX** · Important · affected: mirror registry for Red Hat OpenShift, mirror registry for Red Hat OpenShift 2 · no fix planned: mirror registry for Red Hat OpenShift 2, mirror registry for Red Hat OpenShift · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json) - **RHSA-2026:70267** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70267)