Description
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.
Affected products
redhat: openshift update service; redhat: quay
References2
- access.redhat.com/security/cve/CVE-2026-74241 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2516141 Issue TrackingVendor Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 24 · as of 12 November 2026
- CWE
- CWE-90
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.