EUVD-2026-58817
GHSA-3vf7-35c7-wgcv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible API (AV:N), low complexity, but requires a valid IdP-issued token (PR:L); partial C and I from unauthorized registry access; no availability impact described.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
AnalysisAI
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacker who already holds a legitimately-issued token from the same configured identity provider to bypass audience (aud), authorized party (azp), and subject (sub) restrictions. Affected deployments include Red Hat Quay 3 and Red Hat OpenShift Update Service across all currently tracked versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already possess a validly-signed JWT issued by the same identity provider that is configured in the target Red Hat Quay instance - tokens from unrelated or untrusted IdPs are not usable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium rating reflects the genuine but bounded nature of the risk: the attack vector is network-accessible (AV:N), complexity is low (AC:L), but low-privilege access is required (PR:L), meaning an attacker must already hold a valid token issued by the same IdP. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a valid JWT from the same identity provider integrated with the target Quay instance - whether through credential theft, insider access, or control of a lower-privileged account - submits a token to the Quay API with `aud`, `azp`, or `sub` values targeting a higher-privileged robot account or another user's SSO session. Because Quay fails to enforce these claims strictly, the token is accepted and the attacker gains read or write access to container image repositories they are not authorized to access. … |
| Remediation | Monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-74240 and the associated Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2516139 for patch availability; no exact patched version number was confirmed in the data available at time of analysis, so patch status is described as patch available per vendor advisory pending version confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today