CVE-2026-74244 is a moderate severity vulnerability in Red Hat Quay's Stripe billing webhook handler caused by missing validation of the Stripe-Signature header. This allows unauthenticated attackers to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. Successful exploitation can lead to unauthorized resetting of a namespace's build quota to its maximum and cause unsolicited billing emails to be sent to namespace administrators. The vulnerability is present even when billing is disabled but has reduced impact in self-hosted deployments using FakeStripe. The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). No official patch is currently available, and mitigation relies on network-level access restrictions.

An attacker can forge billing events without authentication, leading to unauthorized resetting of build quotas to maximum values and triggering unsolicited billing emails to namespace administrators. This impacts resource availability and user experience but does not affect confidentiality or availability directly. The vulnerability does not require user interaction and has a high integrity impact but no confidentiality or availability impact.

No official patch or fix is currently available for this vulnerability. To mitigate the risk, restrict network access to the /webhooks/stripe endpoint by configuring firewalls to allow connections only from trusted Stripe IP addresses. If Stripe billing integration is not used, block access to this endpoint entirely. Apply and verify network changes carefully, noting that service restarts or reloads may temporarily impact Red Hat Quay availability.