CVE-2026-74242

4.4 mediumEPSS 0.3%

Medium (4.4) in redhat. EPSS 0.3% chance of exploitation in the next 30 days.

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.

Severity

CVSS 3.1

4.4 medium

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-08-14
Modified: 2026-08-20
Record from: the NVD, synced 2026-10-19

Affected

redhat:openshift_update_service
redhat:quay

References

https://access.redhat.com/security/cve/CVE-2026-74242
https://bugzilla.redhat.com/show_bug.cgi?id=2516140

Check your stack JSON