CVE-2026-74243 — MEDIUM (6.5)

Vulnerability Description

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Redhat	Openshift Update Service	-
Redhat	Quay	3.0.0

Related Weaknesses (CWE)

CWE-306

References

https://access.redhat.com/security/cve/CVE-2026-74243Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2516142Issue TrackingVendor Advisory

FAQ

What is CVE-2026-74243?

CVE-2026-74243 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. ...

How severe is CVE-2026-74243?

CVE-2026-74243 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-74243?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openshift Update Service, Redhat Quay.