CVE-2026-74243

This CVE exposes a critical design flaw in Red Hat Quay's security scanner authentication: the pre-shared key (PSK) is implemented as an optional environment variable that, when absent, silently removes authentication from a network-accessible endpoint. The application functions normally in this state, creating a default-insecure deployment that depends entirely on operator knowledge rather than safe defaults. The path traversal injection compounds this significantly. An unauthenticated attacker with queue-flood access can manipulate URL paths sent to the Clair API. While the CVSS describes this as "blind" injection, the Clair service in Quay deployments is typically co-located on the same internal network bus, giving attackers far more context than a typical blind injection scenario. This transforms a queue exhaustion DoS into potential pivot access to every image scan result, layer composition, and package manifest that Quay has ever processed. Quay sits at the foundation of containerized deployments — it's the registry that provisions images across your infrastructure. The PSK bypass on a dev instance that gets promoted to production isn't just operator failure; it's the blast radius of treating foundational infrastructure as "probably internal." The EPSS score of 0.00256 measures isolated CVE exploitation probability and cannot capture this cascading risk profile. For defenders: audit your Quay deployments immediately for the absence of the security scanner PSK environment variable. Treat any instance where the scanner endpoint responded without authentication as potentially compromised — review access logs for unusual queue activity and image scan patterns. The path traversal vector means you should also audit what the Clair integration is configured to access and whether co-location with Quay creates additional exposure. This is not merely a DoS vulnerability; it's an authentication bypass that grants queue manipulation access to an internal service holding sensitive deployment metadata. Security-critical authentication must fail safely when absent rather than degrading to an unauthenticated state. This is the 47th CVE in the last five years following the optional-auth-env-var pattern — the recurrence rate indicates this is a class failure, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.