CVE-2026-74243: Quay: unauthenticated secscan notification endpoint in quay when psk is unset
A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.
Other sources
A flaw was found in Red Hat Quay's security scanner notification endpoint. When SECURITYSCANNERV4PSK is unset (the default configuration), the /secscan/notification endpoint at endpoints/secscan.py accepts anonymous POST requests with no authentication. An attacker can flood the secscan notification queue and inject notificationid values containing path traversal characters into Clair API URL paths. The impact is worker resource exhaustion and blind path manipulation on the configured Clair host. Operator-managed deployments auto-generate the PSK, limiting exposure to standalone installations that have not explicitly configured the pre-shared key.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In operator-managed deployments or standalone Quay where SECURITY_SCANNER_V4_PSK is unset (default), configure SECURITY_SCANNER_V4_PSK so the /secscan/notification endpoint at endpoints/secscan.py no longer accepts anonymous POST requests.
Red Hat Quay (secscan notification endpoint, endpoints/secscan.py) SECURITY_SCANNER_V4_PSK = set to a non-empty pre-shared key - Compensating control
If you cannot immediately set SECURITY_SCANNER_V4_PSK, restrict network access to the /secscan/notification endpoint (/endpoints/secscan.py) and related Clair API URL paths so only trusted Quay-internal components can reach them, preventing unauthenticated flooding of the secscan notification queue and path traversal attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74243?
CVE-2026-74243 has a medium severity score of 6.5.
What software is affected by CVE-2026-74243?
CVE-2026-74243 affects Red Hat Quay.
How do I mitigate CVE-2026-74243?
To mitigate CVE-2026-74243, ensure that the SECURITY_SCANNER_V4_PSK is set to prevent unauthenticated access.
What type of vulnerability is CVE-2026-74243?
CVE-2026-74243 is classified as a Path Traversal vulnerability.
What can an attacker do with CVE-2026-74243?
An attacker can flood the notification queue and potentially inject path traversal characters into requests.