Red Hat Quay CVE-2026-74245

Exploitation requires the attacker to first obtain a valid exported log file ID. These IDs are not publicly enumerable or guessable - they must be intercepted from the plaintext email notification or HTTP webhook callback that Quay sends to administrators upon log export completion. Consequently, the log export feature must be actively in use (an administrator must have triggered an export) and the delivery channel must be susceptible to interception (plaintext SMTP or unprotected HTTP webhook). Organizations that have never used the action log export feature, or that deliver export notifications exclusively over verified encrypted channels, are not exposed. Exploitation is bounded to confidentiality impact only - the endpoint does not accept writes and cannot be used to modify or delete data. The CVSS PR:N designation applies to the download action itself, not to triggering the export, which requires authenticated administrator access.

The vendor-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the endpoint's unauthenticated network exposure and high confidentiality impact, but overstates practical exploitability in isolation: obtaining a valid file ID requires either intercepting email or webhook traffic, which introduces a real-world barrier not captured by AC:L. EPSS at 0.31% (23rd percentile) independently corroborates that automated, opportunistic exploitation is unlikely. There is no CISA KEV listing and no known POC, so exploitation remains in the realm of targeted, actor-initiated attacks rather than commodity threats. Organizations that use the log export feature and deliver export notifications over unencrypted SMTP or unprotected HTTP webhook endpoints face meaningful risk, particularly in environments where network-layer interception is feasible. The impact is limited strictly to confidentiality - no integrity or availability consequence exists.

An attacker with a man-in-the-middle position on an organization's email infrastructure - or with access to an unencrypted SMTP relay - intercepts a Quay action log export notification and extracts the file ID embedded in the download link. The attacker then issues an unauthenticated HTTP GET request to the Quay export download endpoint using the captured file ID, successfully retrieving the full exported action log containing usernames, email addresses, IP addresses, and detailed action metadata. No public POC has been identified, and the attack requires no special tooling beyond the ability to read intercepted email or webhook traffic.