Strix
26.1K

CVE-2026-32591

MEDIUMCVSS 5.5/10EPSS 0.24%

Last modified

CVE-2026-32591 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. EPSS estimates a 0.24% chance of exploitation in the next 30 days.

Description

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

EPSS Probability
0.24%

15.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RedhatMirror Registry For Red Hat OpenshiftAll versions
RedhatMirror Registry For Red Hat Openshift2.0
RedhatQuay3.0.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2026-32591?
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
How severe is CVE-2026-32591?
CVE-2026-32591 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.
How do I fix CVE-2026-32591?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-32591?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST