Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases
OpenShift oc-mirror flaw CVE-2026-75939 can bypass release signature checks and poison disconnected registries.
Red Hat disclosed CVE-2026-75939, an important flaw in the OpenShift oc-mirror tool with a preliminary CVSS v3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The RHEL9 oc-mirror plugin checks PGP signature errors before processing the full signed body, so an attacker who can tamper with the signature endpoint can present a forged signature that still appears to reference a valid Red Hat release key. Mirrored release images can then enter a disconnected registry as trusted content. No security erratum is available and Red Hat says no mitigation meets its criteria; the RHEL8 plugin is unaffected.
- Preliminary CVSS 7.4: network, high complexity, no privileges, high confidentiality and integrity.
- RHEL9 oc-mirror plugin is affected; the RHEL8 plugin is not.
- No security erratum or broadly deployable mitigation is available yet.
- Attackers who tamper with the signature endpoint can forge a trusted-looking PGP message.
Vulnerabilities mentionedAll →
- CVE-2026-759397.4—PGP Signature Verification Bypass in OpenShift oc-mirrorpublished · openshift oc-mirror
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-75939 | PGP Signature Verification Bypass in OpenShift oc-mirror CVE-2026-75939 is a signature verification bypass vulnerability in the openshift/oc-mirror tool. The flaw is triggered when the tool incorrectly processes PGP release image signatures, allowing an attacker to forge a signature that appears valid. A remote attacker could intercept network traffic to supply a malicious payload, bypassing verification to mirror a compromised software release into a disconnected registry. This directly threatens the integrity of software deployments in affected OpenShift environments. There is no known public proof-of-concept or active exploitation in the wild. Do: Upgrade oc-mirror to a version that includes a fix for CVE-2026-75939. Verify the integrity of your mirrored software payloads. Monitor Red Hat and upstream security advisories for updates. |
Full article505 words · extracted from gbhackers.com · click to collapse
Red Hat disclosed an important OpenShift vulnerability that could let attackers bypass release-image signature checks and introduce malicious payloads into disconnected registries.
This issue, tracked as CVE-2026-75939, affects the `openshift/oc-mirror` tool and has a preliminary CVSS v3.1 score of 7.4.
Administrators use `oc-mirror` to retrieve release images from upstream sources and then copy them to an internal registry for isolated clusters. This workflow is designed to maintain the provenance of images when clusters cannot access public registries.
Red Hat OpenShift Flaw
According to Red Hat, the `oc-mirror` tool performs PGP signature verification incorrectly. It checks for signature errors before processing the entire signed body, which creates a condition that allows verification to be bypassed.
An adversary who can intercept or manipulate traffic to the signature endpoint could create a PGP message that appears to identify a valid Red Hat release key ID but contains a forged signature.
If the organization accepts this altered metadata or release payload, it could mirror into the organization’s disconnected registry as if it passed the trust check.
Subsequent deployments might then use content controlled by the attacker, but operators would mistakenly consider it trusted. Red Hat warns that this vulnerability significantly risks the integrity of software deployed in disconnected environments.
The attack is reachable over the network, requires no privileges or user interaction, and is highly complex. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Both confidentiality and integrity impacts are rated as High, while availability is rated as None. The vulnerability is linked to CWE-347, which pertains to improper verification of cryptographic signatures.
Red Hat has identified the `openshift4/oc-mirror-plugin-rhel9` component in OpenShift Container Platform 4 as affected. The RHEL8 plugin is not affected since this component is absent.
The vendor advises that, unless explicitly stated otherwise, prior package versions in the listed update streams should be presumed vulnerable, even if they have not been fully analyzed.
Currently, no security erratum is available, and Red Hat states that a mitigation is either unavailable or does not meet its criteria for broad, stable, and practical deployment. Therefore, organizations must rely on compensating controls while awaiting a fixed package or advisory update.
Organizations using disconnected mirroring should identify systems running the affected RHEL9 `oc-mirror` plugin, limit and monitor access to the signature-retrieval network paths, and review proxy, DNS, TLS inspection, and egress controls to detect potential tampering.
They should also validate mirrored release digests and provenance through independent channels before promoting any content into production.
Until updates are available, incident-response teams should retain mirror logs and compare registry contents with manifests after each synchronization.
Logging mirror operations, restricting registry write permissions, preserving known-good release manifests, and investigating any unexpected image-digest changes are essential practices to prevent poisoned content from becoming part of the deployment baseline.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.