CVE-2026-74244CWE-347

CVE-2026-74244

Medium · published August 15, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-08-15T03:16Z
Affected products (2)
ProductVersionsFixed in
redhat/openshift_update_serviceall versions—
redhat/quayall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-74244 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2516143 · [email protected]
EPSS history
Timeline
  • 14 AUG 22:43Z
    Quay: stripe webhook accepts forged events without signature verification in quay
    cvelistv5