Quay’s proxy‑cache feature allows an organization administrator to specify an upstream registry for caching. The application does not validate the supplied hostname, allowing the administrator to provide a crafted address that forces Quay to establish an outgoing connection to any target reachable from the Quay host. Consequently, sensitive internal services, cloud‑infrastructure endpoints, and other normally protected resources may be queried or even accessed by the attacker. This vulnerability enables the exfiltration of private data or the exploitation of services that are not intended to be exposed, representing a moderate‑severity security risk. The weakness is identified as a server‑side request forgery (CWE‑918).

Red Hat Quay version 3 and the Red Hat mirror registry components for OpenShift, including mirror registry 1 and mirror registry 2. These components are commonly deployed on OpenShift clusters and are responsible for handling container image distribution and caching.

The CVSS score of 5.2 indicates moderate severity, and the exploit requires organization‑administrator privileges to inject the malicious hostname. Because the attack vector is not publicly reachable without privileged configuration access, the overall risk is moderate, with some dependency on internal access controls. No publicly available exploit data or KEV listing is present, and EPSS data is not available. The risk is mainly driven by the lack of hostname validation and the potential to reach unintended internal resources.