CVE-2026-74244: Quay: stripe webhook accepts forged events without signature verification in quay
A flaw was found in Red Hat Quay's Stripe billing webhook handler. The /webhooks/stripe endpoint at endpoints/webhooks.py accepts incoming JSON requests without validating the Stripe-Signature header, allowing an unauthenticated attacker to forge billing events. The endpoint is registered unconditionally, even when FEATUREBILLING is disabled. An attacker can forge charge.succeeded events to reset a namespace's build quota to the server-configured maximum and trigger unsolicited billing emails (invoice, payment-failed, subscription-change) to namespace administrators. The checkout.session.completed path calls stripe.SetupIntent.retrieve with attacker-controlled IDs, but subsequent mutations use values from Stripe's response rather than the attacker's payload. Impact is Medium-High for quay.io deployments with real Stripe integration and Low for self-hosted defaults using FakeStripe.
Other sources
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify endpoints/webhooks.py so the /webhooks/stripe endpoint validates the Stripe-Signature header for all incoming requests; do not accept forged charge.succeeded/billing events without a valid signature.
Red Hat Quay (webhooks/stripe endpoint) Stripe-Signature header validation = Validate Stripe-Signature on /webhooks/stripe (endpoints/webhooks.py) and reject requests without a valid signature - Configuration
Ensure the /webhooks/stripe endpoint is not registered or does not accept requests when FEATURE_BILLING is disabled (currently it is registered unconditionally).
Red Hat Quay FEATURE_BILLING = Register/enable Stripe webhook only when FEATURE_BILLING is enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74244?
The severity of CVE-2026-74244 is rated as medium with a score of 5.9.
How do I fix CVE-2026-74244?
To fix CVE-2026-74244, ensure that the Stripe-Signature header is validated on incoming requests to the /webhooks/stripe endpoint.
What impacts does CVE-2026-74244 have?
CVE-2026-74244 allows unauthenticated attackers to forge billing events by sending fake requests to the webhook endpoint.
Which software is affected by CVE-2026-74244?
CVE-2026-74244 affects Red Hat Quay.
When was CVE-2026-74244 published?
CVE-2026-74244 was published on August 14, 2026.