EUVD-2026-58819
GHSA-9hvx-vhh3-2359
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable API requiring authenticated repo-admin access (PR:L) and UUID guessing (AC:H); only confidentiality is impacted via secret disclosure, with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
AnalysisAI
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email addresses - to any authenticated repository administrator who can enumerate or guess a target notification's UUID. The flaw is an Insecure Direct Object Reference (CWE-639): the notification UUID acts as the sole access control key, with no ownership check verifying that the requesting admin belongs to the repository whose notification is being accessed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold repository administrator privileges on at least one repository within the target Quay instance (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately frames the trade-offs: the vulnerability is network-reachable and requires only low-privilege access (any repository admin), but attack complexity is High because the attacker must successfully obtain or guess a valid notification UUID belonging to a different repository. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Quay repository administrator calls the notification configuration API endpoint, substituting a guessed or previously leaked UUID belonging to a notification in a different team's repository. The API returns the full notification configuration, exposing a Slack bot token or CI/CD webhook URL with embedded credentials. … |
| Remediation | The primary fix is to apply the Red Hat-released patch for Quay 3 and the OpenShift Update Service once published; consult https://access.redhat.com/security/cve/CVE-2026-74242 for the exact patched version numbers, as these were not confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today