What is CVE-2026-74244?
A flaw was discovered in Red Hat Quay's Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Immediate implementation of signature verification is required to mitigate this vulnerability.
Azərbaycanca: Bu boşluq Red Hat Quay məhsulunun Stripe billing webhook handler-də aşkarlanıb. Doğrulama olmadığı üçün autentifikasiyasız hücumçu `/webhooks/stripe` ünvanına saxta JSON sorğular göndərərək billing hadisələrini saxtalaşdıra bilər. Bu zəiflikdən qorunmaq üçün dərhal Stripe-Signature header yoxlaması tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-306; shared vendor: Stripe
FAQ2
What can an unauthenticated attacker do by exploiting CVE-2026-74244?
An unauthenticated attacker can forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint.
What measure should be implemented to mitigate CVE-2026-74244?
Immediate implementation of signature verification is required to mitigate this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.