EUVD-2026-58820
GHSA-vxqv-j38r-6jmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Quay notification endpoint
-
DeliveryConfirm PSK absent via unauthenticated POST acceptance
-
ExploitFlood queue with high-volume crafted payloads
-
ExecutionInject path traversal sequences into Clair API URL fields
-
PersistExhaust Quay worker thread pool
-
ImpactVulnerability scanning and dependent services unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the SECURITY_SCANNER_V4_PSK configuration value is absent or empty in the Red Hat Quay deployment - this is the single necessary and sufficient condition for the authentication bypass. When the PSK is properly set, the notification endpoint enforces key-based authentication and rejects unauthenticated POST requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no special complexity is required once the PSK-absent condition is met. Exploitation is further limited to: (1) the attacker must have network reachability to the Quay notification endpoint (typically an internal or internet-facing HTTP/HTTPS port), (2) the path traversal impact is blind - the attacker receives no response content from Clair, limiting usefulness beyond DoS, and (3) downstream integrity impact is confined to manipulation of Clair API URL paths on the configured Clair host, not arbitrary file system traversal on Quay itself. |
| Impact | The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) reflects a network-reachable, zero-complexity, unauthenticated attack with high availability impact and low integrity impact - a strong paper score. However, EPSS at 0.26% (17th percentile) indicates very low current exploitation probability, and the vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation at time of analysis. The real-world risk is therefore more nuanced: the attack is trivially automatable (AV:N/AC:L/PR:N) for any Quay instance with an exposed notification endpoint and no PSK configured, but the impact is limited to DoS and blind path manipulation against an internal Clair host - there is no confidentiality breach and no direct code execution path. The path traversal impact is described as 'blind,' meaning the attacker cannot read traversal responses, limiting the I:L impact further. Priority should be elevated for internet-exposed Quay deployments lacking PSK configuration; internal-only deployments face reduced risk from the availability vector but should still patch to eliminate the authentication gap. |
| Exploit ScenarioDerived | An attacker enumerates or identifies an internet-exposed Red Hat Quay instance, confirms the security scanner notification endpoint accepts unauthenticated POST requests (indicating absent PSK), and then scripted-floods the endpoint with high-volume crafted payloads containing path traversal sequences such as '../' in URL-relevant fields. The notification queue fills, worker threads are exhausted processing illegitimate entries, and legitimate Clair scan notifications are dropped or delayed - effectively rendering vulnerability scanning non-functional and potentially causing broader Quay service degradation. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 20, 2026
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Earlier versions of this analysis (1)
Red Hat Quay's security scanner notification endpoint, when SECURITY_SCANNER_V4_PSK is not configured, accepts unauthenticated remote POST requests that flood the internal notification queue and inject path traversal sequences into Clair vulnerability-scanner API URL paths. Affected deployments span Red Hat Quay 3 and Red Hat OpenShift Update Service across all tracked CPE version ranges. Impact is bounded by the 'blind' nature of the path traversal - no response data is returned to the attacker - and limited availability degradation via worker resource exhaustion; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
The primary fix is to configure the SECURITY_SCANNER_V4_PSK setting in Red Hat Quay so that the security scanner notification endpoint enforces pre-shared key authentication, eliminating unauthenticated access. Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-74243 for patched package versions and upgrade instructions specific to your Quay 3 or OpenShift Update Service deployment. An exact fixed version is not independently confirmed from the available data - verify the precise patched release via the Red Hat advisory before upgrading. As a compensating control prior to patching, network-level access controls (firewall rules or ingress policies) restricting POST access to the notification endpoint to only the Clair scanner's IP or internal network segment will substantially reduce exposure; note this does not address the underlying authentication gap and may require tuning if Clair runs on dynamic infrastructure. Operators should also audit existing Quay configurations to confirm whether SECURITY_SCANNER_V4_PSK is set and rotate or set the key immediately on any instance where it is absent.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Red Hat Quay is an enterprise container image registry that integrates with Clair (a container vulnerability scanner) via a webhook-style notification API. The SECURITY_SCANNER_V4_PSK is a pre-shared key intended to authenticate POST callbacks delivered to Quay's security scanner notification endpoint, implementing a lightweight HMAC or token-based guard. CWE-306 (Missing Authentication for Critical Function) captures the root cause: when the PSK is not configured, the endpoint performs no credential validation, allowing arbitrary callers to submit notification payloads. The path traversal component (tagged separately) arises because attacker-controlled data in those unauthenticated payloads is interpolated into Clair API URL path construction without sanitization, enabling blind manipulation of the downstream API calls Quay makes to Clair. Affected products per CPE data: cpe:2.3:a:red_hat:red_hat_quay_3 and cpe:2.3:a:red_hat:red_hat_openshift_update_service.
Know when Red Hat Openshift Update Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-reachable unauthenticated endpoint (AV:N/PR:N); absent PSK is a configuration gap, not an inherent complexity barrier (AC:L); DoS is primary impact (A:H) with blind path traversal as secondary (I:L); no confidentiality breach.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
Executive ViewAI
Red Hat Quay 3 and OpenShift Update Service are vulnerable to unauthenticated denial-of-service attacks against the security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK configuration is absent, enabling attackers to exhaust scanner worker resources and disrupt container vulnerability scanning operations. Organizations running these products without this pre-shared key configured face potential disruption of security scanning in CI/CD pipelines and risk allowing unscanned container images into production.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Configure SECURITY_SCANNER_V4_PSK with a strong random value (minimum 32 characters) to enable authentication; (2) Restrict network access to the scanner notification endpoint to trusted Clair instances only via firewall or service mesh policies; (3) Implement API rate limiting on the endpoint; (4) Deploy WAF rules to block path traversal patterns; (5) Enable detailed logging and alerting on endpoint access patterns and scanner queue depth metrics.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Exploit-DB