Red Hat Quay CVE-2026-74244

Exploitation requires network connectivity to the Red Hat Quay instance's /webhooks/stripe HTTP endpoint. No authentication token, user session, or API credential is required (CVSS PR:N confirmed). The Stripe billing integration must be enabled and the /webhooks/stripe endpoint must be reachable by the attacker - instances behind a firewall that blocks external access to this path, or deployments that have not configured Stripe billing, are not exploitable. The integrity impact is limited to namespace build quota state and email delivery; no code execution, credential access, or data exfiltration is possible through this vulnerability. Exploitation is bounded to namespaces whose identifiers or billing context the attacker can enumerate or guess.

The CVSS 7.5 High vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the trivial attack path: the endpoint is network-exposed, requires no credentials, and processes crafted input with no user interaction. However, the business impact ceiling is bounded - the attacker can manipulate build quotas and trigger administrative emails, but cannot read data (C:N), execute code, or disrupt service availability (A:N), which meaningfully limits operational blast radius. EPSS of 0.14% at the 4th percentile confirms no observed active exploitation at time of analysis, and the vulnerability is not listed in CISA KEV. This gap between the CVSS severity and the low EPSS probability is consistent with a high-severity-but-low-attacker-interest profile, likely because quota manipulation has limited monetization value compared to RCE or data theft vectors. That said, the zero-complexity, zero-authentication exploit path means any operator running internet-exposed Quay instances with Stripe billing enabled should treat patching as a near-term priority rather than a deferred task.

An attacker with HTTP access to a Quay instance sends a crafted POST request to /webhooks/stripe with a JSON body mimicking a legitimate Stripe billing event - for example, a customer.subscription.updated event with parameters designed to trigger quota reset logic. Because no Stripe-Signature validation occurs, Quay accepts the forged event and resets the targeted namespace's build quota to its maximum configured value, potentially enabling that namespace to exceed intended resource limits. No public exploit code has been identified, but the attack requires only basic HTTP tooling.