CVE-2026-74244

Summary

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.

Affected Software

Weaknesses

• CWE-347: Improper Verification of Cryptographic Signature

Workarounds

To mitigate this vulnerability, restrict network access to the /webhooks/stripe endpoint in Red Hat Quay. Configure network firewalls to allow connections to this endpoint only from trusted Stripe IP addresses or block access if Stripe billing integration is not utilized. This prevents unauthenticated attackers from forging billing events. Ensure any network changes are applied and services are reloaded or restarted as necessary for the changes to take effect, which may temporarily impact Quay service availability.

References

• https://access.redhat.com/security/cve/CVE-2026-74244
• https://bugzilla.redhat.com/show_bug.cgi?id=2516143

• ←Previous
• Next→