CVE-2026-74244 is an improper signature verification flaw (CWE-347) in the Stripe billing webhook of Red Hat Quay. The endpoint at /webhooks/stripe does not check the Stripe-Signature header. The record rates it Medium at 5.9. Restrict the endpoint and apply the Red Hat update.
What's affected
The record lists Red Hat Quay and OpenShift Update Service as affected, with no version ranges. Red Hat's page rates the flaw Moderate and gives network restriction as the mitigation. Use the Red Hat CVE page to find the update for your release.
Severity, as two sources state it. The record gives 5.9 (Medium), with high attack complexity, matching Red Hat and cve.org. The NVD vector shown on the Red Hat page uses low attack complexity, which would raise the score. All sources agree that no account is needed and that the main impact is on integrity.
How to check if you're exposed
Red Hat Quay does not publish a single version number in the record, so start with your own deployment.
oc get csv -A | grep -i quay
oc get quayregistry -A
These commands apply to Quay run on OpenShift through the operator. For a standalone installation, check the Quay image tag in your deployment files. Then compare it with the fixed releases on the Red Hat CVE page linked under Sources, since the record lists affected products but no fixed versions. Red Hat's page is the place to confirm which errata apply to your subscription.
Check whether you use Stripe billing in Quay. If you do not, nothing legitimate should ever call that endpoint.
What to do now
- Apply the Red Hat update that fixes signature verification. Confirm the release on the Red Hat CVE page.
- Until then, limit access to /webhooks/stripe to trusted Stripe IP addresses with a firewall rule, as Red Hat suggests.
- If Stripe billing is not used, block the endpoint completely.
- Check namespace build quotas and billing email logs for changes you cannot explain.
- Tell namespace administrators what the unexpected billing emails mean if they arrive.
Why it matters
The weakness is improper verification of a cryptographic signature, CWE-347. Webhook senders such as Stripe sign each event so the receiver can confirm it is genuine. Skipping that step means the endpoint believes whatever JSON arrives. The record says an unauthenticated attacker can send crafted requests that reset a namespace's build quota to its maximum and trigger billing emails to namespace administrators.
The damage is limited, which is why the score is Medium, but forged billing events can mislead people and consume build capacity. The same missing check appears in many webhook handlers, and it is quick to test: send an unsigned request in a staging environment and see whether it is accepted. KEV status is false.
Quick check
Why is a webhook signature important?
It proves that the sender is the real service. Without it, any caller who knows the URL can send events.
Is my registry content at risk?
The record describes quota resets and unsolicited emails, not access to images.
Sources
Last reviewed: 18 October 2026.
