{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74240", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-14T19:46:37.190Z", "datePublished": "2026-08-14T22:43:01.103Z", "dateUpdated": "2026-08-14T22:43:01.103Z"}, "containers": {"cna": {"title": "Quay: jwt claim validation bypasses in quay federated robot and sso authentication", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-update-service/openshift-update-service-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_update_service:5"]}, {"vendor": "Red Hat", "product": "Red Hat Quay 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quay/quay-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quay:3"]}, {"vendor": "Red Hat", "product": "Red Hat Quay 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quay/quay-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quay:3"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-74240", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516139", "name": "RHBZ#2516139", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "Improper Authentication", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-287: Improper Authentication", "workarounds": [{"lang": "en", "value": "To mitigate this issue, Red Hat Quay administrators should ensure that federated robot authentication is configured with specific audiences to enable 'verify_aud' enforcement. Additionally, review and update existing federation configurations to explicitly include and enforce 'azp' and 'sub' claims, preventing bypasses when these claims are absent. Refer to Red Hat Quay documentation for detailed configuration steps. A restart of affected Quay services may be required after configuration changes."}], "timeline": [{"lang": "en", "time": "2026-08-03T09:28:14.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-14T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-08-14T22:43:01.103Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_update_service:5"], "defaultStatus": "affected", "packageName": "openshift-update-service/openshift-update-service-rhel8", "product": "Red Hat OpenShift Update Service", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quay:3"], "defaultStatus": "affected", "packageName": "quay/quay-rhel8", "product": "Red Hat Quay 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quay:3"], "defaultStatus": "affected", "packageName": "quay/quay-rhel9", "product": "Red Hat Quay 3", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations."}], "id": "CVE-2026-74240", "lastModified": "2026-08-14T23:16:33.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-08-14T23:16:33.960", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-74240"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516139"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue.", "bugzilla": {"description": "quay: JWT claim validation bypasses in Quay federated robot and SSO authentication", "id": "2516139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516139"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-287", "details": ["A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Red Hat Quay administrators should ensure that federated robot authentication is configured with specific audiences to enable 'verify_aud' enforcement. Additionally, review and update existing federation configurations to explicitly include and enforce 'azp' and 'sub' claims, preventing bypasses when these claims are absent. Refer to Red Hat Quay documentation for detailed configuration steps. A restart of affected Quay services may be required after configuration changes."}, "name": "CVE-2026-74240", "package_state": [{"cpe": "cpe:/a:redhat:openshift_update_service:5", "fix_state": "Fix deferred", "package_name": "openshift-update-service/openshift-update-service-rhel8", "product_name": "Red Hat OpenShift Update Service"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Fix deferred", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Fix deferred", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}], "public_date": "2026-08-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74240\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74240"], "statement": "This Moderate impact flaw in Red Hat Quay allows an attacker with a validly-signed token from the same identity provider to bypass configured audience, subject, or authorized-client restrictions. This is due to default configurations for federated robot authentication not enforcing audience verification, and insufficient checks for 'azp' and 'sub' claims in certain scenarios. Exploitation requires a pre-existing valid token from the same IdP, limiting the attack surface.", "threat_severity": "Moderate"}

{}