CVE-2026-74242
published 2026-08-14CVE-2026-74242: A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can…
PriorityP422medium4.4CVSS 3.1
AVNACHPRHUINSUCHINAN
EPSS
0.33%
25.6th percentile
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift-update-service | openshift-update-service-rhel8 | — | — |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| redhat | quay | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
quay: Repository notification UUID IDOR in Quay API
vendor_redhat·2026-08-14·CVSS 5.3
CVE-2026-74242 [MEDIUM] CWE-639 quay: Repository notification UUID IDOR in Quay API
quay: Repository notification UUID IDOR in Quay API
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
Statement: This Moderate impact flaw in Red Hat Quay allows an authenticated repository administrator to potentially access sensitive notification configurations and trigger test notifications for other repositories. Exploitation requires knowledge of a specific 128-bit notif
GHSA
A flaw was found in Red Hat Quay.
ghsa_unreviewed·2026-08-15
CVE-2026-74242 [MEDIUM] CWE-639 A flaw was found in Red Hat Quay.
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
VulDB
Red Hat Quay Notification Configuration privileges management
vuldb·2026-08-15·CVSS 5.3
CVE-2026-74242 [MEDIUM] Red Hat Quay Notification Configuration privileges management
A vulnerability classified as problematic was found in Red Hat Quay. Affected by this issue is some unknown functionality of the component Notification Configuration. The manipulation results in improper privilege management.
This vulnerability was named CVE-2026-74242. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
2026-08-14
Published