CVE-2026-74243 in OpenShift Update Service
Summary
by MITRE • 08/15/2026
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within Red Hat Quay's security scanning functionality where the absence of a properly configured SECURITY_SCANNER_V4_PSK parameter creates a critical authentication gap. The flaw allows unauthenticated remote attackers to exploit the security scanner notification endpoint through POST requests, effectively bypassing intended access controls that should require pre-shared key validation for legitimate notifications.
The technical implementation of this vulnerability stems from insufficient input validation and authentication checks within the notification handling mechanism. When the pre-shared key is not configured, the system fails to properly verify the authenticity of incoming requests to the security scanner endpoint, creating an attack surface where any remote actor can submit malicious payloads without proper authorization. This configuration oversight enables attackers to manipulate the notification queue through flood attacks that overwhelm system resources.
The operational impact of this vulnerability extends beyond simple resource exhaustion to include potential path traversal exploitation within the Clair API URL paths. Attackers can inject malicious path traversal characters that may allow them to manipulate file paths on the configured Clair host, potentially leading to unauthorized access patterns or information disclosure. The combination of queue flooding and blind path manipulation creates a multi-dimensional attack vector that can effectively disable the security scanning service while potentially compromising underlying system integrity.
This vulnerability aligns with CWE-345 Insufficient Verification of Data Authenticity and CWE-20 Improper Input Validation, both of which address authentication failures and input sanitization issues in security-critical components. The attack pattern follows ATT&CK technique T1210 Lateral Tool Transfer and T1498 Resource Hijacking, where attackers consume system resources to disrupt normal operations. Organizations using Red Hat Quay should immediately implement proper pre-shared key configuration for the security scanner endpoint and consider additional monitoring of notification queue activity to detect anomalous patterns.
The mitigation strategy requires immediate deployment of the SECURITY_SCANNER_V4_PSK parameter with a strong cryptographic key, ensuring that all security scanner notifications are properly authenticated before processing. System administrators should also implement rate limiting on the notification endpoint to prevent queue flooding attacks, while monitoring for suspicious path traversal patterns in Clair API requests. Additional defensive measures include network segmentation to limit access to the security scanner endpoint and regular auditing of notification queue behavior to identify potential exploitation attempts.