CVE-2026-74245

The vulnerability in Red Hat Quay's log export functionality exposes a design-level category error: the system uses a complex identifier as a secret, but delivers that identifier over fundamentally insecure channels. The file ID — generated as an internal reference for authenticated sessions — was later exposed via email and webhook delivery without realizing the implicit trust boundary had shifted. This isn't a missing authorization check in isolation; it's an authorization model built on assumptions that don't survive contact with reality. What's critical to understand: attackers don't need to brute force anything. They intercept the plaintext email or webhook payload containing the download URL, then use the embedded ID to retrieve the file. The 'complex' ID provides zero protection because it was never handled as a credential — no rotation, no anomalous access logging, no recipient binding, no additional authentication factors. It simply existed in plaintext, performing a job it was never designed to do. The blast radius matters here. Quay isn't storing throwaway data — it holds container images, build configurations, and deployment metadata. Exposed logs reveal usernames, email addresses, IP addresses, and operation-specific metadata tied to your organization's internal users. That's an intelligence package for targeted attacks, not just PII. For immediate action: treat this as higher severity than the CVSS 5.9 suggests. Audit your webhook and email archives for historical log export payloads — the UUIDs likely escaped before any patch ships. When evaluating the fix, distinguish between security theater (rotating IDs) and real remediation (adding an authorization gate that proves the caller had export permission for that specific file, tied to the export workflow). Prioritize deploying signed URLs with short TTLs and recipient-bound authentication rather than relying on entropy. Implement access logging on all download endpoints so interception becomes detectable, not just preventable. This pattern — UUID-as-credential over plaintext delivery — has a two-decade vulnerability lineage. The organizational memory of what leaked and when won't close with a patch alone.

Reviewed through automated stages and approved by a human before publication.