CVE-2026-74241: Quay: ldap referral filter injection in quay external ldap authentication
A flaw was found in Red Hat Quay's external LDAP authentication handling. When an LDAP referral is returned during authentication, the referral handler at data/users/externalldap.py:700 constructs a search filter using the raw usernameoremail input without applying escapefilterchars(), unlike the normal authentication path which correctly escapes the input. This allows LDAP filter metacharacters (, (, )) in the username to be injected into the referral path's search filter. While SCOPEBASE limits the search to a single DN (preventing directory enumeration) and a separate simplebinds password check prevents direct authentication bypass, an attacker could use this to perform user-existence oracle attacks at the referral DN and potentially influence which DN enters the password bind in multi-domain Active Directory environments.
Other sources
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate LDAP referral filter injection by preventing LDAP referrals from being followed during Quay external LDAP authentication, so that the referral handler does not construct the referral search filter from the raw username_or_email input at data/users/externalldap.py:700.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74241?
CVE-2026-74241 has a medium severity rating of 4.8.
How does CVE-2026-74241 affect Red Hat Quay?
CVE-2026-74241 allows for LDAP referral filter injection in the external LDAP authentication process.
How do I fix CVE-2026-74241?
To mitigate CVE-2026-74241, ensure that Red Hat Quay is updated to a version that includes the fix for the LDAP referral handling issue.
What software is affected by CVE-2026-74241?
The vulnerability CVE-2026-74241 affects Red Hat Quay.
Where can I find more information about CVE-2026-74241?
For detailed information on CVE-2026-74241, refer to documentation and announcements from Red Hat.