CVE-2026-74245 is a moderate severity vulnerability in Red Hat Quay's exported logs feature. It allows an unauthenticated attacker possessing a valid file ID to download exported action logs without authorization. Although file IDs are complex, they can be intercepted from plaintext email or webhook callbacks, exposing sensitive information including usernames, email addresses, IP addresses, and metadata related to actions. Deployments using LocalStorage backends are particularly vulnerable due to indefinite persistence of log files. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

The vulnerability leads to unauthorized disclosure of sensitive log data, including personally identifiable information and action metadata. This exposure can compromise user privacy and operational security. There is no impact on integrity or availability. The risk is elevated in environments using LocalStorage backends where logs persist indefinitely.

Red Hat advises configuring Red Hat Quay to use a cloud storage backend for exported logs, which provides time-limited download URLs to reduce exposure. Additionally, securing all communication channels that deliver exported log file IDs, such as email and webhook callbacks, to prevent interception of file IDs in plaintext is recommended. No official patch or fix is currently available; patch status is not yet confirmed — check the Red Hat advisory for updates.