Quay: stripe webhook accepts forged events without signature verification in quay
Summary
| CVE | CVE-2026-74244 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-14 23:16:34 UTC |
| Updated | 2026-08-20 20:01:38 UTC |
| Description | A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.001410000 probability, percentile 0.039740000 (date 2026-08-18)
Problem Types: CWE-347 | CWE-347 Improper Verification of Cryptographic Signature
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | CNA | CVSS | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Openshift Update Service | - | All | All | All |
| Application | Redhat | Quay | 3.0.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat OpenShift Update Service | Not specified | Not specified |
| CNA | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-74244 | [email protected] | access.redhat.com | Vendor Advisory |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-03T09:28:14.000Z | Reported to Red Hat. |
| CNA | 2026-08-14T00:00:00.000Z | Made public. |
Workarounds
CNA: To mitigate this vulnerability, restrict network access to the `/webhooks/stripe` endpoint in Red Hat Quay. Configure network firewalls to allow connections to this endpoint only from trusted Stripe IP addresses or block access if Stripe billing integration is not utilized. This prevents unauthenticated attackers from forging billing events. Ensure any network changes are applied and services are reloaded or restarted as necessary for the changes to take effect, which may temporarily impact Quay service availability.