Red Hat Quay CVE-2026-74241

Exploitation requires three concurrent conditions: (1) Red Hat Quay must be configured to use external LDAP authentication - deployments using local accounts, OAuth, or OIDC are not affected; (2) the LDAP backend must return a referral response during the authentication flow, which occurs most commonly in multi-domain Active Directory forests or LDAP topologies using referral-based load distribution - single-domain flat LDAP directories that do not issue referrals are not exploitable via this path; (3) the attacker must have network access to the Quay authentication endpoint. Authentication is not required prior to exploitation (PR:N per CVSS vector). The primary factor limiting exploitation is the LDAP referral requirement (AC:H), which is a non-default behavior absent in many simpler LDAP deployments.

The NVD CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N accurately reflects the constrained but real-world risk. The AC:H rating is the critical limiting factor: exploitation is only possible when the LDAP server returns a referral during authentication, a behavior dependent on the specific LDAP topology (common in multi-domain AD forests but absent in simple flat-directory deployments). The PR:N rating confirms no prior authentication is needed, which is significant for a network-exposed container registry. Practical impact is bounded: C:L reflects the user-existence oracle (an attacker learns valid usernames, useful for credential stuffing or targeted phishing), and I:L reflects potential manipulation of the DN used in bind operations, which in some AD configurations could affect which account context is validated. This is not a remote code execution issue. No EPSS data was provided in the source intelligence; CISA KEV status is negative; no POC is known. For organizations using Quay with LDAP backed by multi-domain AD, this is a genuine medium-priority issue requiring patching. For deployments using single-domain LDAP without referrals, exploitation probability is functionally near zero.

An attacker with network access to the Red Hat Quay authentication endpoint submits a login request with a crafted username containing LDAP filter metacharacters, such as a value like *)(uid=*))(|(uid=*. If the target LDAP server returns a referral response during the authentication attempt - typical in multi-domain AD environments - Quay forwards the unescaped username to the referral DN, where the injected metacharacters modify the LDAP filter logic. The attacker iterates through candidate usernames, using response timing or error differences to determine which accounts exist in the directory, building a valid user list for downstream attacks.