PGP Signature Verification Bypass in OpenShift oc-mirror
CVSS 3.1
7.4high
EPSS
—
Published
()
Modified
AI analysis
CVE-2026-75939 is a signature verification bypass vulnerability in the openshift/oc-mirror tool. The flaw is triggered when the tool incorrectly processes PGP release image signatures, allowing an attacker to forge a signature that appears valid. A remote attacker could intercept network traffic to supply a malicious payload, bypassing verification to mirror a compromised software release into a disconnected registry. This directly threatens the integrity of software deployments in affected OpenShift environments. There is no known public proof-of-concept or active exploitation in the wild.
What to do: Upgrade oc-mirror to a version that includes a fix for CVE-2026-75939. Verify the integrity of your mirrored software payloads. Monitor Red Hat and upstream security advisories for updates.
Affected
openshift oc-mirror
All versions prior to the security patch are potentially vulnerable.
Estimated exposure
nicheUnknown, but likely in the low-to-mid thousands of OpenShift environments. — Exposure is based on the tool's role in OpenShift disconnected environments, which are common but not universally deployed.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.
OpenShift oc-mirror flaw CVE-2026-75939 can bypass release signature checks and poison disconnected registries.
Red Hat disclosed CVE-2026-75939, an important flaw in the OpenShift oc-mirror tool with a preliminary CVSS v3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The RHEL9 oc-mirror plugin checks PGP signature errors before processing the full signed body, so an attacker who can tamper with the signature endpoint can present a forged signature that still appears to reference a valid Red Hat release key. Mirrored release images can then enter a disconnected registry as trusted content. No security erratum is available and Red Hat says no mitigation meets its criteria; the RHEL8 plugin is unaffected.
Red Hat OpenShift oc-mirror can accept forged PGP signatures, letting attackers mirror malicious release images into disconnected registries.
Red Hat disclosed CVE-2026-75939, a CVSS 7.4 flaw in the OpenShift oc-mirror plugin for RHEL 9. The tool checks PGP signature errors before finishing the signed message, so a forged message carrying a valid Red Hat release key ID can be accepted. An attacker who can alter traffic to the signature endpoint could mirror a malicious release image into a disconnected registry. No mitigation met Red Hat’s criteria at the September 21, 2026 disclosure, and the RHEL 8 plugin is not affected.