EUVD-2026-58822
GHSA-jr6g-vw27-98vc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
File ID acquisition depends on intercepting plaintext email or webhook traffic outside the attacker's direct control, warranting AC:H over the vendor's AC:L.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
AnalysisAI
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first obtain a valid exported log file ID. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the endpoint's unauthenticated network exposure and high confidentiality impact, but overstates practical exploitability in isolation: obtaining a valid file ID requires either intercepting email or webhook traffic, which introduces a real-world barrier not captured by AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a man-in-the-middle position on an organization's email infrastructure - or with access to an unencrypted SMTP relay - intercepts a Quay action log export notification and extracts the file ID embedded in the download link. The attacker then issues an unauthenticated HTTP GET request to the Quay export download endpoint using the captured file ID, successfully retrieving the full exported action log containing usernames, email addresses, IP addresses, and detailed action metadata. … |
| Remediation | Apply the vendor-issued patch from Red Hat; consult the advisory at https://access.redhat.com/security/cve/CVE-2026-74245 for confirmed fixed version numbers, as exact patch versions are not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Quay 3 deployments and identify audit log export notification methods (email, webhooks, API integrations); verify whether notifications use encryption (TLS for email, HTTPS for webhooks). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today