EUVD-2026-58821
GHSA-fgq8-mwjv-6335
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Endpoint is network-exposed with no authentication prerequisite and no special configuration required; impact is integrity-only with no confidentiality or availability consequence.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionNVD
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.
AnalysisAI
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network connectivity to the Red Hat Quay instance's /webhooks/stripe HTTP endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the trivial attack path: the endpoint is network-exposed, requires no credentials, and processes crafted input with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with HTTP access to a Quay instance sends a crafted POST request to /webhooks/stripe with a JSON body mimicking a legitimate Stripe billing event - for example, a customer.subscription.updated event with parameters designed to trigger quota reset logic. Because no Stripe-Signature validation occurs, Quay accepts the forged event and resets the targeted namespace's build quota to its maximum configured value, potentially enabling that namespace to exceed intended resource limits. … |
| Remediation | Apply the vendor-released patch as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-74244. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Red Hat Quay deployments and immediately restrict network access to the /webhooks/stripe endpoint to trusted Stripe IP ranges or disable it entirely if billing webhooks are not critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today