CVE-2026-74242CWE-639

CVE-2026-74242

Medium · published August 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-15T03:16Z
Affected products (2)
ProductVersionsFixed in
redhat/openshift_update_serviceall versions—
redhat/quayall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-74242 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2516140 · [email protected]
EPSS history
Timeline
  • 14 AUG 22:43Z
    Quay: repository notification uuid idor in quay api
    cvelistv5