Bug 2516145 (CVE-2026-74245)

Summary:	CVE-2026-74245 quay: Unauthenticated exported logs download in Quay
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aruklets, doconnor
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-14 19:51:42 UTC

A flaw was found in Red Hat Quay's exported logs feature. The /exportedlogs/<file_id> endpoint at endpoints/web.py:411 has no authentication decorator, allowing any caller with a valid file ID to download exported action logs without authentication. While the file ID is 256 bits (two UUID4s) making blind enumeration infeasible, the ID is delivered via plaintext email and webhook callbacks, creating interception opportunities. On cloud storage backends the download URL expires in 1 hour, but on LocalStorage backends exported log files persist indefinitely and the unauthenticated endpoint serves them with no time limit. Exported logs contain usernames, email addresses, IP addresses, action types, and action-specific metadata.