CVE-2026-74244

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system fails to validate the Stripe-Signature header, which is used to verify that the request originated from Stripe. This can result in the unauthorized resetting of a namespace build quota to its maximum and the triggering of unsolicited billing emails to namespace administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.