CVE-2026-74243 Quay: unauthenticated secscan notification endpoint in quay when psk is unset

Medium 6.5 Published 14 Aug 2026 Updated 18 Aug 2026

Unauthenticated attackers can cause denial of service and path manipulation in Red Hat Quay if the security scanner pre-shared key is not configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-74243?

CVE-2026-74243 is a medium-severity missing authorization vulnerability in Red Hat OpenShift Update Service, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

Weakness: CWE-306

Which versions are affected by CVE-2026-74243?

It affects 2 products.

Products include Redhat Openshift Update Service, Redhat Quay.

How do I fix CVE-2026-74243?

No fix has been published for CVE-2026-74243 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-74243 being exploited?

There is no known exploitation of CVE-2026-74243 in the wild and no public exploit code.

Sources

Also known as GHSA-vxqv-j38r-6jmm.