CVE-2025-57854

The CVE-2025-57854 issue affects OpenShift Update Service (OSUS) images where the /etc/passwd file is created with group-writable permissions during build. Under certain conditions, a non-root user who can run commands in an affected container could leverage membership in the root group to modify...

CVE-2026-74241

Summary: CVE-2026-74241 affects Red Hat Quay’s external LDAP authentication. When LDAP referrals are returned during authentication, the username input isn’t properly escaped, allowing an attacker to inject LDAP filter metacharacters and perform user-existence oracle checks at the referral DN. Th...

CVE-2026-74240

The CVE concerns Red Hat Quay’s JWT validation for federated robot accounts and SSO, where flawed audience verification and insufficient enforcement of azp and sub allow a token from the same identity provider to bypass security boundaries, potentially leading to unauthorized access where audienc...

CVE-2026-74242

Affects Red Hat Quay. The issue allows a repository administrator to read a notification’s configuration (including webhook URLs, Slack tokens, and email addresses) by knowing or guessing the target notification UUID, and to trigger test notifications for another repository. Root cause: unauthori...

CVE-2026-74247

A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal netwo...

CVE-2026-74243

In Red Hat Quay, when SECURITY_SCANNER_V4_PSK is not configured, unauthenticated attackers can flood the notification queue and inject path traversal characters into Clair API URLs, causing worker resource exhaustion and blind path manipulation on the Clair host. Mitigation: set the pre-shared ke...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74245

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to i...