CVE-2026-74243

Received Received - Intake

Path Traversal in Red Hat Quay Clair API

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Red Hat, Inc.

Description

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-74243

EUVD

EUVD-2026-58820

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	quay	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Red Hat Quay occurs when the SECURITY_SCANNER_V4_PSK setting is missing. An unauthenticated remote attacker can send POST requests to the security scanner notification endpoint. This floods the notification queue and allows path traversal characters to be injected into Clair API URL paths. The main impact is worker resource exhaustion and potential blind path manipulation on the Clair host, leading to a denial of service.

Impact Analysis

The vulnerability can cause system downtime by exhausting worker resources and disrupting security scanning operations. It may also allow unauthorized path manipulation on the Clair host, potentially exposing sensitive data or interfering with system functionality.

Mitigation Strategies

Set the SECURITY_SCANNER_V4_PSK environment variable with a strong pre-shared key to prevent unauthenticated POST requests to the security scanner notification endpoint. Ensure Clair API URL paths are validated to prevent path traversal attacks.

Hi! I’m here to help you understand CVE-2026-74243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70