CVE-2026-74244

Published: Ago 15, 2026 Last Modified: Ago 15, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.

347

Improper Verification of Cryptographic Signature

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Integrity Confidentiality
Potential Impacts:
Gain Privileges Or Assume Identity Modify Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-74244
https://access.redhat.com/security/cve/CVE-2026-74244
https://bugzilla.redhat.com/show_bug.cgi?id=2516143
https://bugzilla.redhat.com/show_bug.cgi?id=2516143