CVE-2026-74240

The CVSS 5.4 assigned to CVE-2026-74240 substantially understates the actual risk in federated Quay deployments. The vulnerability describes simultaneous failures in three JWT claim validations — audience, azp, and sub — that together allow a validly-signed token to bypass configured security restrictions. In the CVSS vector, this maps to authentication integrity bypass, which typically elevates impact scores. The Medium rating appears to rely on the 'High' attack complexity from requiring a token 'from the same identity provider,' but this constraint is dangerously misleading in federated architectures. In Quay's federation model, 'same identity provider' encompasses every organization already granted mutual trust within the federation — not a narrow attacker pool. Robot accounts in federated Quay are explicitly designed for cross-organization image replication and mirroring, meaning a single authentication bypass doesn't target one repository or organization. It inherits the full permission graph of every downstream service trusting that robot account. The blast radius of this flaw is topologically unbounded within the federation. The 'multiple issues' phrasing in the description is a red flag. When CVE descriptions bundle claim validation failures rather than enumerating specific failure sequences, it typically indicates the reporter documented an exploitable chain without a holistic audit of the validation pipeline. This pattern recurs across federated authentication systems: vendors patch the reported chain while leaving the fragmented validation architecture intact, creating conditions for subsequent CVEs within 12-24 months. The EPSS score of 0.0019 compounds the miscalibration. EPSS measures historical exploitation patterns against known CVE activity — it doesn't capture architecture-specific exploitability in federated trust chains where the attacker already has IdP adjacency. The low score likely reflects either a narrow deployment base or EPSS's structural blind spot to federated topologies, not genuinely low exploitability. **Actionable guidance for operators:** First, audit your Quay deployment's JWT validation code paths to confirm all three claims (audience, azp, sub) are validated in a unified pipeline with proper error handling — if they're separate code paths, assume additional bypass modes exist. Second, map your robot account topology to identify which cross-organization replication and mirroring accounts would be compromised by an authentication bypass, as these represent the actual blast radius. Third, verify that legacy authentication paths (standalone robot accounts with shared secrets or API keys) were fully removed during federation migration — 'deprecated' paths frequently survive in production. Fourth, recognize that remediation in federated deployments is not point-in-time: the exposure window closes only when every federation partner has patched and audited their trust chains, which creates a materially longer remediation timeline than the CVSS implies.

Reviewed through automated stages and approved by a human before publication.