Description

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T23:16:34.360Z",
  "pubdate": "2026-08-14T23:16:34.360Z",
  "executiveSummary": "A critical security vulnerability has been identified in Red Hat Quay concerning the security scanner notification endpoint. The flaw arises when the SECURITY_SCANNER_V4_PSK configuration parameter is not explicitly set, leaving the endpoint unprotected. This architectural oversight empowers remote, unauthenticated attackers to transmit malicious POST requests directly to the notification endpoint. The primary impacts of this vulnerability include severe worker resource exhaustion and blind path manipulation on the configured Clair host, ultimately posing a significant risk of denial of service against the affected infrastructure. Exploitation requires network access to the Quay instance and relies on the absence of pre-shared key authentication for the security scanner notification mechanism. The risk implication is high, as malicious actors can disrupt container image scanning operations and manipulate internal API request paths without holding any valid credentials or privileges within the system.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper access control enforcement on the security scanner notification endpoint within Red Hat Quay when the SECURITY_SCANNER_V4_PSK pre-shared key is omitted or left unconfigured. Because authentication is not enforced at the application boundary for this endpoint, remote unauthenticated attackers can interact with it directly over the network.\nThe attack flow proceeds as an attacker sends crafted HTTP POST requests to the security scanner notification endpoint. Due to the lack of pre-shared key validation, the application processes these unauthenticated incoming requests. The attacker leverages this capability to execute two primary malicious vectors: flooding the internal notification queue and injecting path traversal characters into the Clair API URL paths constructed by Quay.\nDuring payload processing, the injected path traversal sequences are incorporated directly into requests destined for the configured Clair host. This blind path manipulation alters the intended request routing to the Clair API. Concurrently, dispatching high volumes of forged notification requests exhausts backend worker resources, degrading system performance and leading to a denial of service condition for legitimate scanning operations.\nThe vulnerable component is the security scanner notification handling mechanism in Red Hat Quay. The prerequisites for exploitation include network exposure of the Quay instance and the absence of the SECURITY_SCANNER_V4_PSK setting. The attacker operates entirely without authentication or elevated privileges, relying solely on network accessibility to the exposed notification endpoint."
}