CVE-2026-74241

Published: Aug 14, 2026Modified: Aug 20, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.

Affected (2)

Products: Redhat: Openshift Update Service, Quay

2 products

Openshift Update Service

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Update Service	All versions
Redhat Quay	Version 3.0.0

Related CWEs

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

References (2)

https://access.redhat.com/security/cve/CVE-2026-74241

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2516141

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.