CVE-2026-74242
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Red Hat Quay, an administrator of any repository, by knowing or guessing a target notification's UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. They can also trigger test notifications for another repository.
Risk Assessment
This leads to unauthorized information disclosure and potential misuse of notification services.
Recommendation
Restrict access to notification configuration and consider using unpredictable UUIDs and additional authorization mechanisms.
Original NVD description (English source)
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.