CVE-2026-74243

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw exists when the SECURITY SCANNER V4 PSK (pre-shared key) is not configured. A remote unauthenticated attacker can send POST requests to the security scanner notification endpoint, enabling them to flood the notification queue and inject path traversal characters into Clair API URL paths. This can result in worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

Recommendations Set the SECURITY SCANNER V4 PSK pre-shared key to secure the security scanner notification endpoint.