CVE-2026-74242: Quay: repository notification uuid idor in quay api
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.
Other sources
A flaw was found in Red Hat Quay's repository notification API endpoints. The GET and test-trigger endpoints in endpoints/api/repositorynotification.py look up notifications by UUID without verifying that the notification belongs to the repository specified in the URL path. An admin of any repository who knows or guesses a target notification's UUID can read the notification configuration (including webhook URLs, Slack tokens, and email addresses) and fire test notifications for another repository's notification. The DELETE and reset endpoints correctly scope by repository. Exploitation requires knowing a 128-bit notification UUID.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Quay repository notification API endpoints (endpoints/api/repositorynotification.py) so only authorized administrators for a given repository can call the GET and test-trigger operations that use a repository path plus a notification UUID.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74242?
CVE-2026-74242 has a medium severity rating of 5.3.
How do I fix CVE-2026-74242?
To mitigate CVE-2026-74242, ensure that access controls are correctly implemented and restrict knowledge of repository notification UUIDs.
What type of vulnerability is CVE-2026-74242?
CVE-2026-74242 is an IDOR (Insecure Direct Object Reference) vulnerability.
What products are affected by CVE-2026-74242?
CVE-2026-74242 affects Red Hat Quay.
What can an attacker do with CVE-2026-74242?
An attacker can read sensitive notification configurations by guessing the UUID of the notifications.