CVE-2026-74246

A flaw was found in Red Hat Quay's custom build trigger handler. This vulnerability allows a user with organization repository administrative privileges and the FEATURE_BUILD_SUPPORT enabled to read arbitrary files on the build worker. This is possible due to insufficient validation of the build source configuration, which permits the use of a file:// Uniform Resource Identifier (URI) scheme. Exploiting this flaw can lead to unauthorized information disclosure.