CVE-2026-74240— Quay: jwt claim validation bypasses in quay federated robot and sso authentication
Quick assessment
Affected
Red Hat Red Hat OpenShift Update Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Quay是美国Red Hat公司的一个容器镜像仓库管理组件。 Red Hat Quay存在授权问题漏洞，该漏洞源于JWT验证中受众验证及azp和sub声明执行不当，可能导致攻击者利用相同身份提供者的有效签名令牌绕过安全限制，实现未授权访问。
Possible ATT&CK Techniques 1 AI
T1199 · Trusted RelationshipAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service | any |
affected |
| Red Hat | Red Hat Quay 3 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74240
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Quay: jwt claim validation bypasses in quay federated robot and sso authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Quay 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Quay是美国Red Hat公司的一个容器镜像仓库管理组件。 Red Hat Quay存在授权问题漏洞，该漏洞源于JWT验证中受众验证及azp和sub声明执行不当，可能导致攻击者利用相同身份提供者的有效签名令牌绕过安全限制，实现未授权访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service | - |
cpe:/a:redhat:openshift_update_service:5
|
|
| Red Hat | Red Hat Quay 3 | - |
cpe:/a:redhat:quay:3
|
|
| Red Hat | Red Hat Quay 3 | - |
cpe:/a:redhat:quay:3
|
|
II. Public POCs for CVE-2026-74240
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74240
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74240 (2)
Same Patch Batch · Red Hat · 2026-08-14 · 11 CVEs total
| CVE-2026-58224 | 6.5 MEDIUM | Samba: ctdb fails to do integrity checking of received packets |
| CVE-2026-74243 | 6.5 MEDIUM | Quay: unauthenticated secscan notification endpoint in quay when psk is unset |
| CVE-2026-74244 | 5.9 MEDIUM | Quay: stripe webhook accepts forged events without signature verification in quay |
| CVE-2026-74245 | 5.9 MEDIUM | Quay: unauthenticated exported logs download in quay |
| CVE-2026-19617 | 5.5 MEDIUM | Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser |
| CVE-2026-19879 | 5.3 MEDIUM | Io.undertow/undertow: undertow: http response header integrity issue due to character trun |
| CVE-2026-74242 | 5.3 MEDIUM | Quay: repository notification uuid idor in quay api |
| CVE-2026-74241 | 4.8 MEDIUM | Quay: ldap referral filter injection in quay external ldap authentication |
| CVE-2026-13002 | 4.4 MEDIUM | Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing |
| CVE-2026-74247 | 4.2 MEDIUM | Quay: ssrf via build archive_url in quay build api |
IV. Related Vulnerabilities
Same product: Red Hat OpenShift Update Service
-
CVE-2026-74247
Quay: ssrf via build archive_url in quay build api -
CVE-2026-74245
Quay: unauthenticated exported logs download in quay -
CVE-2026-74244
Quay: stripe webhook accepts forged events without signature -
CVE-2026-74243
Quay: unauthenticated secscan notification endpoint in quay -
CVE-2026-74242
Quay: repository notification uuid idor in quay api
Same vendor: Red Hat
-
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
Same weakness: CWE-287
-
CVE-2026-14378
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass -
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command In -
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue -
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identif -
CVE-2026-75957
Ultimate Multisite <= 2.15.0 - Unauthenticated Authenticatio
V. Comments for CVE-2026-74240
No comments yet