CVE-2026-74243 is a vulnerability in Red Hat Quay where, if the SECURITY_SCANNER_V4_PSK (pre-shared key) is unset, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This enables the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary impact is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially resulting in denial of service. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The risk is primarily present in standalone Quay installations without the pre-shared key configured, while operator-managed deployments automatically generate this key, mitigating the issue.

The vulnerability allows unauthenticated attackers to flood the security scanner notification endpoint, causing worker resource exhaustion and blind path manipulation on the Clair host. This can lead to denial of service conditions. There is no direct confidentiality impact, but integrity and availability impacts are low to moderate. The issue is limited to standalone Quay installations without the SECURITY_SCANNER_V4_PSK configured.

To mitigate this vulnerability, configure the SECURITY_SCANNER_V4_PSK pre-shared key in standalone Red Hat Quay installations. This enables authentication for the security scanner notification endpoint and prevents unauthenticated access. Operator-managed deployments already generate this key automatically and are not affected. After setting the key, a restart of the Quay service may be required. No official patch is indicated; the mitigation is configuration-based.