EUVD-2026-58820
GHSA-vxqv-j38r-6jmm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-reachable unauthenticated endpoint (AV:N/PR:N); absent PSK is a configuration gap, not an inherent complexity barrier (AC:L); DoS is primary impact (A:H) with blind path traversal as secondary (I:L); no confidentiality breach.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
5DescriptionNVD
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
AnalysisAI
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the SECURITY_SCANNER_V4_PSK configuration value is absent or empty in the Red Hat Quay deployment - this is the single necessary and sufficient condition for the authentication bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) reflects a network-reachable, zero-complexity, unauthenticated attack with high availability impact and low integrity impact - a strong paper score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates or identifies an internet-exposed Red Hat Quay instance, confirms the security scanner notification endpoint accepts unauthenticated POST requests (indicating absent PSK), and then scripted-floods the endpoint with high-volume crafted payloads containing path traversal sequences such as '../' in URL-relevant fields. The notification queue fills, worker threads are exhausted processing illegitimate entries, and legitimate Clair scan notifications are dropped or delayed - effectively rendering vulnerability scanning non-functional and potentially causing broader Quay service degradation. … |
| Remediation | The primary fix is to configure the SECURITY_SCANNER_V4_PSK setting in Red Hat Quay so that the security scanner notification endpoint enforces pre-shared key authentication, eliminating unauthenticated access. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Red Hat Quay 3 and OpenShift Update Service deployments to confirm SECURITY_SCANNER_V4_PSK is configured with a strong, cryptographically random value; if absent, enable it immediately using a minimum 32-character random string. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Same technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today