Red Hat Openshift Update Service vulnerabilities

8 CVEs affecting Red Hat Openshift Update Service, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-74247, published 2026-08-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-74243, published 2026-08-14. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint.…
CVE-2026-74245, published 2026-08-14. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are…
CVE-2026-74242, published 2026-08-14. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration,…
CVE-2026-74241, published 2026-08-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly…
CVE-2026-74240, published 2026-08-14. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the…
CVE-2026-74247, published 2026-08-14. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This…
CVE-2026-74244, published 2026-08-14. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the…
CVE-2025-57854, published 2026-04-08. Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days. A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created with group-writable permissions during…