Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases
OpenShift oc-mirror flaw CVE-2026-75939 can bypass release signature checks and poison disconnected registries.
64
Vulnerability1 · 1 read
CVE-2026-75939
PGP Signature Verification Bypass in OpenShift oc-mirror
- CVSS 3.1
- 7.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-75939 is a signature verification bypass vulnerability in the openshift/oc-mirror tool. The flaw is triggered when the tool incorrectly processes PGP release image signatures, allowing an attacker to forge a signature that appears valid. A remote attacker could intercept network traffic to supply a malicious payload, bypassing verification to mirror a compromised software release into a disconnected registry. This directly threatens the integrity of software deployments in affected OpenShift environments. There is no known public proof-of-concept or active exploitation in the wild.
What to do: Upgrade oc-mirror to a version that includes a fix for CVE-2026-75939. Verify the integrity of your mirrored software payloads. Monitor Red Hat and upstream security advisories for updates.
| Product | Affected |
|---|---|
| openshift oc-mirror | All versions prior to the security patch are potentially vulnerable. |
Estimated exposure
nicheUnknown, but likely in the low-to-mid thousands of OpenShift environments. — Exposure is based on the tool's role in OpenShift disconnected environments, which are common but not universally deployed.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.
- Weakness
- CWE-347
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
In the news
2 storiesRed Hat OpenShift Flaw Lets Attackers Bypass PGP Checks and Push Malicious Releases
Red Hat OpenShift oc-mirror can accept forged PGP signatures, letting attackers mirror malicious release images into disconnected registries.
54