CVE-2026-74242
This vulnerability also allows them to trigger test notifications for another repository.
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- redhat/openshift update service · redhat/quay
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2026-74242Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2516140Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.