CVE-2026-74243 is a missing authentication flaw (CWE-306) in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK pre-shared key is not set, anyone who can reach the scanner notification endpoint can flood it. The record rates it Medium at 6.5. Set the key and check Red Hat errata.
What's affected
The record lists Red Hat Quay and OpenShift Update Service as affected products, with no version ranges. Red Hat's CVE page rates the flaw Moderate and says the risk is mainly in standalone Quay installations where the pre-shared key is not set. Check that page for the errata that apply to your release.
Severity, as two sources state it. The record scores 6.5 (Medium) with low availability impact, which matches the vector Red Hat and cve.org publish. The NVD vector listed on the Red Hat page rates availability impact as high, which would give a higher number. Both agree the attacker needs no account.
How to check if you're exposed
Red Hat Quay does not publish a single version number in the record, so start with your own deployment.
oc get csv -A | grep -i quay
oc get quayregistry -A
These commands apply to Quay run on OpenShift through the operator. For a standalone installation, check the Quay image tag in your deployment files. Then compare it with the fixed releases on the Red Hat CVE page linked under Sources, since the record lists affected products but no fixed versions. Red Hat's page is the place to confirm which errata apply to your subscription.
Then look at your Quay configuration for SECURITY_SCANNER_V4_PSK. If it is missing or empty, you are in the group the advisory describes.
What to do now
- Set SECURITY_SCANNER_V4_PSK in the Quay configuration, as the Red Hat mitigation says. Restart the Quay service if needed for it to take effect.
- Check the Red Hat CVE page for the fixed release and plan the update.
- Make sure the scanner notification endpoint is not reachable from the internet.
- Watch worker queue depth. A sudden flood of notifications is the symptom.
- Check the Clair host logs for strange request paths.
Why it matters
The weakness is missing authentication for a critical function, CWE-306. The endpoint accepts notifications from the Clair scanner. Without the shared key, nothing proves that a caller is Clair. The record describes two consequences: a flood of requests into the notification queue, and path traversal characters injected into the Clair API URL paths, which allows blind manipulation of paths on the configured Clair host.
Shared keys are a simple control, and a setting that defaults to empty is easy to miss during installation. The wider lesson for registry operators is that the components around a registry, the scanner, the webhooks and the build system, deserve the same hardening as the registry itself. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the quickest fix?
Set SECURITY_SCANNER_V4_PSK, which Red Hat gives as the mitigation, and apply the update from the Red Hat page.
Does this expose my images?
The record describes resource exhaustion and blind path manipulation, not image disclosure.
Sources
Last reviewed: 18 October 2026.
