CVE-2026-74243— Quay: unauthenticated secscan notification endpoint in quay when psk is unset
Quick assessment
Affected
Red Hat Red Hat OpenShift Update Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Quay是美国Red Hat公司的一个容器镜像仓库管理组件。 Red Hat Quay存在授权问题漏洞，该漏洞源于SECURITY_SCANNER_V4_PSK（预共享密钥）未设置时，远程未认证攻击者可向安全扫描器通知端点发送POST请求，导致通知队列被淹没，并可向Clair API URL路径注入路径遍历字符，造成worker资源耗尽和盲路径操作，可能导致拒绝服务。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1498 · Network Denial of ServiceAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service | any |
affected |
| Red Hat | Red Hat Quay 3 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74243
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Quay: unauthenticated secscan notification endpoint in quay when psk is unset
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Quay 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Quay是美国Red Hat公司的一个容器镜像仓库管理组件。 Red Hat Quay存在授权问题漏洞，该漏洞源于SECURITY_SCANNER_V4_PSK（预共享密钥）未设置时，远程未认证攻击者可向安全扫描器通知端点发送POST请求，导致通知队列被淹没，并可向Clair API URL路径注入路径遍历字符，造成worker资源耗尽和盲路径操作，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service | - |
cpe:/a:redhat:openshift_update_service:5
|
|
| Red Hat | Red Hat Quay 3 | - |
cpe:/a:redhat:quay:3
|
|
| Red Hat | Red Hat Quay 3 | - |
cpe:/a:redhat:quay:3
|
|
II. Public POCs for CVE-2026-74243
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74243
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74243 (2)
-
-
🔗 2516142 – (CVE-2026-74243) CVE-2026-74243 quay: Unauthenticated secscan notification endpoint in Quay when PSK is unset Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-08-14 · 11 CVEs total
| CVE-2026-58224 | 6.5 MEDIUM | Samba: ctdb fails to do integrity checking of received packets |
| CVE-2026-74244 | 5.9 MEDIUM | Quay: stripe webhook accepts forged events without signature verification in quay |
| CVE-2026-74245 | 5.9 MEDIUM | Quay: unauthenticated exported logs download in quay |
| CVE-2026-19617 | 5.5 MEDIUM | Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser |
| CVE-2026-74240 | 5.4 MEDIUM | Quay: jwt claim validation bypasses in quay federated robot and sso authentication |
| CVE-2026-19879 | 5.3 MEDIUM | Io.undertow/undertow: undertow: http response header integrity issue due to character trun |
| CVE-2026-74242 | 5.3 MEDIUM | Quay: repository notification uuid idor in quay api |
| CVE-2026-74241 | 4.8 MEDIUM | Quay: ldap referral filter injection in quay external ldap authentication |
| CVE-2026-13002 | 4.4 MEDIUM | Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing |
| CVE-2026-74247 | 4.2 MEDIUM | Quay: ssrf via build archive_url in quay build api |
IV. Related Vulnerabilities
Same product: Red Hat OpenShift Update Service
-
CVE-2026-74247
Quay: ssrf via build archive_url in quay build api -
CVE-2026-74245
Quay: unauthenticated exported logs download in quay -
CVE-2026-74244
Quay: stripe webhook accepts forged events without signature -
CVE-2026-74242
Quay: repository notification uuid idor in quay api -
CVE-2026-74241
Quay: ldap referral filter injection in quay external ldap a
Same vendor: Red Hat
-
CVE-2026-13087
Kernel: heap out-of-bounds write in the linux kernel rpc-ove -
CVE-2026-90462
Sssd: sssd: fail-open in ldap ppolicy access check allows co -
CVE-2026-94640
Rpcbind: unbounded memory allocation in rpcbind statistics t -
CVE-2026-95619
Gcc: libstdc++ integer overflow in `new` operator -
CVE-2026-95508
Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp resp
Same weakness: CWE-306
-
CVE-2026-17635
IBM Financial Transaction Manager (FTM) is Impacted by Multi -
CVE-2026-77254
MCP Atlassian: Unauthenticated HTTP MCP requests can use glo -
CVE-2026-94455
Unauthenticated /enterprise/create-user mints lifetime top-t -
CVE-2026-65114
CVE-2026-65114 -
CVE-2026-75791
Authentication bypass vulnerability
V. Comments for CVE-2026-74243
No comments yet