CVE-2026-74245: Quay: unauthenticated exported logs download in quay
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
Other sources
A flaw was found in Red Hat Quay's exported logs feature. The /exportedlogs/<fileid> endpoint at endpoints/web.py:411 has no authentication decorator, allowing any caller with a valid file ID to download exported action logs without authentication. While the file ID is 256 bits (two UUID4s) making blind enumeration infeasible, the ID is delivered via plaintext email and webhook callbacks, creating interception opportunities. On cloud storage backends the download URL expires in 1 hour, but on LocalStorage backends exported log files persist indefinitely and the unauthenticated endpoint serves them with no time limit. Exported logs contain usernames, email addresses, IP addresses, action types, and action-specific metadata.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74245?
The severity of CVE-2026-74245 is classified as medium with a score of 5.9.
How do I fix CVE-2026-74245?
To mitigate CVE-2026-74245, ensure proper authentication and authorization mechanisms for accessing exported logs.
What are the potential impacts of CVE-2026-74245?
CVE-2026-74245 can lead to unauthorized access to sensitive action logs by unauthenticated attackers.
Who is affected by CVE-2026-74245?
CVE-2026-74245 affects users of Red Hat Quay who utilize the exported logs feature.
How can an attacker exploit CVE-2026-74245?
An attacker can exploit CVE-2026-74245 by intercepting valid file IDs from plaintext emails or webhook callbacks to download logs.