Is CVE-2026-74241 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74241 being exploited in the wild.

How severe is CVE-2026-74241?

Medium severity, with a CVSS score of 4.8, published 14 August 2026.

Is there a fix for CVE-2026-74241?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-74241 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74241?

Check whether you run Redhat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74241: Red Hat Quay LDAP injection in external authentication

CVE-2026-74241 · Severity: medium · CVSS 4.8 · Published 2026-08-14

Red Hat Quay is a container image registry platform that organizations use to store and manage container images. This vulnerability allows attackers to inject malicious commands into LDAP authentication queries when the system processes LDAP referrals, potentially enabling them to discover which user accounts exist and manipulate authentication binding in multi-domain environments. While direct account compromise is limited, this flaw could facilitate targeted attacks and reconnaissance against organizational authentication infrastructure.

Technologies: Redhat Quay. Vendors: Redhat.

Quick answers

Is CVE-2026-74241 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74241 being exploited in the wild.
How severe is CVE-2026-74241?: Medium severity, with a CVSS score of 4.8, published 14 August 2026.
Which products and versions are affected?: Red Hat Quay <UNKNOWN>.
Is there a fix for CVE-2026-74241?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-74241 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74241?: Check whether you run Redhat Quay. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an LDAP injection (CWE-90) in Red Hat Quay's external LDAP authentication handler. When processing LDAP referrals during authentication, the system fails to properly escape username input before incorporating it into LDAP filter queries. An unauthenticated network attacker can craft malicious usernames containing LDAP metacharacters to conduct user-existence oracle attacks against referral DNs and potentially influence password binding DN selection in multi-domain Active Directory setups. The attack requires high attack complexity but does not require authentication or user interaction. While Red Hat reports no direct mitigation is available, patches may be released for future versions; currently affected systems should restrict LDAP referral processing or disable external LDAP authentication where feasible.

Affected products

Red Hat Quay <UNKNOWN>

Timeline

2026-08-14: disclosed
2026-08-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.