CVE-2026-74240: Quay: jwt claim validation bypasses in quay federated robot and sso authentication
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
Other sources
A flaw was found in Red Hat Quay's JWT token validation for federated robot accounts and SSO authentication. Three related issues were identified: (1) When no audiences are configured for federated robot authentication (the default), verifyaud is set to False, accepting any validly-signed token from the same IdP regardless of intended audience. (2) The OIDCALLOWEDCLIENTS / azp enforcement check in auth/oauth.py short-circuits when the azp claim is absent from the token (None), allowing tokens without an azp claim to bypass client restrictions. (3) Pre-existing federation configurations created before API validation enforcement (or written directly to the database) without a subject field allow tokens without a sub claim to match. These issues could allow an attacker with a validly-signed token from the same identity provider to bypass configured audience, subject, or authorized-client restrictions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74240?
CVE-2026-74240 has a medium severity rating of 5.4.
What are the main issues related to CVE-2026-74240?
The main issues in CVE-2026-74240 involve JWT validation bypass, particularly audience verification and the enforcement of 'azp' and 'sub' claims.
How do I fix CVE-2026-74240?
To fix CVE-2026-74240, ensure that you update to the latest version of Red Hat Quay that contains the necessary security patches.
Who is affected by CVE-2026-74240?
CVE-2026-74240 affects users of Red Hat Quay who utilize federated robot accounts and single sign-on (SSO) authentication.
What could be the potential impact of CVE-2026-74240?
The potential impact of CVE-2026-74240 includes unauthorized access due to JWT validation bypass, which could allow attackers to exploit federated accounts.