Vulnerability in Red Hat Quay’s billing webhook handler allows unauthorized access
CVE-2026-74244

5.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Update Service
Red Hat Quay 3
Vendor
CVE Published:
14 August 2026

What is CVE-2026-74244?

A significant flaw has been identified in the billing webhook handler of Red Hat Quay. This security issue allows unauthorized individuals to forge billing events by sending carefully crafted JSON requests to the /webhooks/stripe endpoint. The vulnerability specifically arises from the absence of validation for the Stripe-Signature header. If successfully exploited, this flaw could enable an attacker to reset a namespace's build quota to its maximum level, as well as trigger unsolicited billing emails to administrators of the affected namespaces. Addressing this vulnerability is crucial to ensure the security and integrity of billing operations within Red Hat Quay.

References

https://access.redhat.com/security/cve/CVE-2026-74244
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2516143
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue.
.