Bug 2516142 (CVE-2026-74243)

Summary: CVE-2026-74243 quay: Unauthenticated secscan notification endpoint in Quay when PSK is unset
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aruklets, doconnor
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-14 19:50:29 UTC 
A flaw was found in Red Hat Quay's security scanner notification endpoint. When SECURITY_SCANNER_V4_PSK is unset (the default configuration), the /secscan/notification endpoint at endpoints/secscan.py accepts anonymous POST requests with no authentication. An attacker can flood the secscan notification queue and inject notification_id values containing path traversal characters into Clair API URL paths. The impact is worker resource exhaustion and blind path manipulation on the configured Clair host. Operator-managed deployments auto-generate the PSK, limiting exposure to standalone installations that have not explicitly configured the pre-shared key.