7.4
High
CVE-2026-75939 A flaw was found in openshift/oc-mirror
Description
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.18 1790828598 | earliest → < 1790828598 | 1790828598 |
References
- RHSA-2026:79039 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2517976 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Container Platform 4
The 629 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
High
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Medium
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
7.4
High
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
High