CVE-2026-74242 in Quay
Summary
by MITRE • 08/15/2026
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability represents a critical access control flaw in Red Hat Quay's notification system that undermines the security model of repository management. The issue stems from insufficient authorization checks when accessing notification configurations, allowing any authenticated repository administrator to bypass normal access controls through simple UUID guessing or enumeration techniques. This weakness directly violates fundamental security principles of least privilege and proper access control enforcement, creating a scenario where administrative privileges can be leveraged to access data belonging to other repositories without proper authorization.
The technical implementation flaw lies in the notification configuration endpoint's lack of repository ownership verification before exposing sensitive configuration details. When an administrator provides a UUID for a notification, the system fails to validate whether the requesting user has legitimate access rights to that specific notification configuration. This vulnerability maps directly to CWE-284 Access Control Bypass and aligns with ATT&CK technique T1078 Valid Accounts, as it allows privilege escalation through legitimate administrative accounts. The flaw enables an attacker to extract webhook URLs that may point to external services, Slack tokens that could provide access to communication channels, and email addresses that serve as attack vectors for social engineering or credential compromise attempts.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates potential for service disruption and data exfiltration. Attackers can trigger test notifications from other repositories, potentially flooding target systems with unwanted alerts or exploiting webhook endpoints to perform unauthorized actions. This capability could be abused to create denial-of-service conditions against external services configured in the notification settings, while the exposure of Slack tokens and email addresses provides additional attack surface for credential harvesting and targeted attacks. The vulnerability also enables information gathering that could support more sophisticated attacks by revealing system architecture details and communication patterns.
Organizations using Red Hat Quay should implement immediate mitigations including mandatory authentication for all notification endpoints, implementation of proper UUID validation checks, and enforcement of repository ownership verification before exposing configuration details. System administrators should review existing notification configurations to identify and revoke any exposed sensitive credentials or tokens that may have been compromised through this vulnerability. The fix should involve implementing a robust access control mechanism that verifies the requesting user's authorization level against the target repository before returning any notification configuration data, ensuring that each notification resource is properly scoped to its owning repository. Additional monitoring should be implemented to detect unauthorized access attempts to notification configurations and test notification triggers across different repositories.