CVE-2026-74245 is a missing authentication flaw (CWE-306) in the exported logs feature of Red Hat Quay. Anyone who holds a valid file ID can download exported action logs. The record rates it Medium at 5.9. Use cloud storage for exports and apply the Red Hat update.
What's affected
The record lists Red Hat Quay and OpenShift Update Service as affected, with no version ranges. Red Hat's CVE page rates it Moderate and notes that deployments with a local storage backend face more risk, because log files persist indefinitely.
Severity, as two sources state it. The record scores 5.9 (Medium) with high attack complexity, matching Red Hat. The NVD vector on the Red Hat page uses low complexity. The complexity is high because the file ID is hard to guess. According to the record, it can be intercepted from plaintext email or webhook callbacks.
How to check if you're exposed
Red Hat Quay does not publish a single version number in the record, so start with your own deployment.
oc get csv -A | grep -i quay
oc get quayregistry -A
These commands apply to Quay run on OpenShift through the operator. For a standalone installation, check the Quay image tag in your deployment files. Then compare it with the fixed releases on the Red Hat CVE page linked under Sources, since the record lists affected products but no fixed versions. Red Hat's page is the place to confirm which errata apply to your subscription.
Then check which storage backend your exported logs use, and how the file ID is delivered to the requester: by email, by webhook, or both.
What to do now
- Apply the Red Hat update once you have confirmed the fixed release on the Red Hat CVE page.
- Configure a cloud storage backend for exported logs. Red Hat says this provides time limited download URLs.
- Secure the channels that deliver export file IDs, so they are not sent in plaintext.
- Delete old exported log files you no longer need, particularly on local storage.
- Treat exported logs as personal data, since they can hold usernames, email addresses and IP addresses.
Why it matters
The weakness is missing authentication for a critical function, CWE-306. The export feature produces a file and shares an identifier. The identifier works as a bearer secret: whoever has it can download the file. It is long and complex, which makes guessing unlikely, but it travels through email and webhook callbacks in plaintext, where it can be intercepted.
The leaked content is action logs: usernames, email addresses, IP addresses and action metadata. That is not code execution, but it is useful for targeting and for privacy exposure. Treating download links as secrets, giving them an expiry and requiring a login are the three habits that prevent this class of issue. KEV status is false.
Quick check
Why does storage backend matter?
Red Hat says cloud storage gives time limited download URLs. Local storage keeps the files indefinitely, so an old ID stays valuable.
Can someone guess the file ID?
The record says the IDs are complex. The risk comes from interception, not guessing.
Sources
Last reviewed: 18 October 2026.
