CVE-2026-74241: redhat openshift_update_service LDAP Injection

Vulnerability summary

CVE-2026-74241 is a medium (CVSS 6.5) LDAP Injection vulnerability in redhat openshift_update_service. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.4% of scored vulnerabilities.

Timeline

1. 14-08-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.

• CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.