VULNERABILITY INTELLIGENCE

CVE-2026-74245

CVSS score5.9 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-08-14
Last modified2026-08-20
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.

Weakness classification

  • CWE-306: Missing Authentication for Critical Function

Primary references