{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74244","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-08-14T19:46:37.191Z","datePublished":"2026-08-14T22:43:06.490Z","dateUpdated":"2026-08-17T18:02:45.187Z"},"containers":{"cna":{"title":"Quay: stripe webhook accepts forged events without signature verification in quay","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Update Service","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-update-service/openshift-update-service-rhel8","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_update_service:5"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel8","defaultStatus":"affected","cpes":["cpe:/a:redhat:quay:3"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel9","defaultStatus":"affected","cpes":["cpe:/a:redhat:quay:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-74244","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516143","name":"RHBZ#2516143","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-08-14T00:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-347: Improper Verification of Cryptographic Signature","workarounds":[{"lang":"en","value":"To mitigate this vulnerability, restrict network access to the `/webhooks/stripe` endpoint in Red Hat Quay. Configure network firewalls to allow connections to this endpoint only from trusted Stripe IP addresses or block access if Stripe billing integration is not utilized. This prevents unauthenticated attackers from forging billing events. Ensure any network changes are applied and services are reloaded or restarted as necessary for the changes to take effect, which may temporarily impact Quay service availability."}],"timeline":[{"lang":"en","time":"2026-08-03T09:28:14.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-14T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-08-14T22:43:06.490Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-17T18:02:36.258815Z","id":"CVE-2026-74244","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-17T18:02:45.187Z"}}]}}