CVE-2026-74245 — MEDIUM (5.9)

Vulnerability Description

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Openshift Update Service	-
Redhat	Quay	3.0.0

Related Weaknesses (CWE)

CWE-306

References

https://access.redhat.com/security/cve/CVE-2026-74245Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2516145Issue TrackingVendor Advisory

FAQ

What is CVE-2026-74245?

CVE-2026-74245 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex,...

How severe is CVE-2026-74245?

CVE-2026-74245 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-74245?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openshift Update Service, Redhat Quay.