CVE-2026-74245
published 2026-08-14CVE-2026-74245: A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.30%
22.7th percentile
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift-update-service | openshift-update-service-rhel8 | — | — |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| redhat | quay | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Red Hat Quay's exported logs feature.
ghsa_unreviewed·2026-08-15
CVE-2026-74245 [MEDIUM] CWE-306 A flaw was found in Red Hat Quay's exported logs feature.
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
VulDB
Red Hat OpenShift Update Service/Quay Exported Logs information disclosure
vuldb·2026-08-15·CVSS 5.9
CVE-2026-74245 [MEDIUM] Red Hat OpenShift Update Service/Quay Exported Logs information disclosure
A vulnerability, which was classified as problematic, was found in Red Hat OpenShift Update Service and Quay. This vulnerability affects unknown code of the component Exported Logs. Such manipulation leads to information disclosure.
This vulnerability is referenced as CVE-2026-74245. It is possible to launch the attack remotely. No exploit is available.
Red Hat
quay: Unauthenticated exported logs download in Quay
vendor_redhat·2026-08-14·CVSS 5.9
CVE-2026-74245 [MEDIUM] CWE-306 quay: Unauthenticated exported logs download in Quay
quay: Unauthenticated exported logs download in Quay
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
Statement: This Moderate impact flaw in Red Hat Quay's exported logs feature allows unauthenticated download of sensitive log data. While file IDs are complex, their transmission via plaintext email and webhooks creates interception opportunities. Deployments using LocalStorage backends are at higher risk du
No detection rules found.
No public exploits indexed.
2026-08-14
Published