CVE-2026-74244

Katalog CVE

CVSS 7.5 · High EPSS 0,23%

Kerentanan Improper Verification of Cryptographic Signature pada redhat openshift update service, redhat quay. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.

Rincian

Terbit di NVD

14 Agustus 2026

Terakhir diubah

20 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-74244 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2516143 issue tracking · advisory vendor