Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases
OpenShift oc-mirror flaw CVE-2026-75939 can bypass release signature checks and poison disconnected registries.
Red Hat disclosed CVE-2026-75939, an important flaw in the OpenShift oc-mirror tool with a preliminary CVSS v3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The RHEL9 oc-mirror plugin checks PGP signature errors before processing the full signed body, so an attacker who can tamper with the signature endpoint can present a forged signature that still appears to reference a valid Red Hat release key. Mirrored release images can then enter a disconnected registry as trusted content. No security erratum is available and Red Hat says no mitigation meets its criteria; the RHEL8 plugin is unaffected.
- Preliminary CVSS 7.4: network, high complexity, no privileges, high confidentiality and integrity.
- RHEL9 oc-mirror plugin is affected; the RHEL8 plugin is not.
- No security erratum or broadly deployable mitigation is available yet.
- Attackers who tamper with the signature endpoint can forge a trusted-looking PGP message.
- CVEs
- CVE-2026-75939
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75939 | PGP Signature Verification Bypass in OpenShift oc-mirror | 7.4 | — |
From the original article
2 min read at gbhackers.com
Red Hat disclosed an important OpenShift vulnerability that could let attackers bypass release-image signature checks and introduce malicious payloads into disconnected registries. This issue, tracked as CVE-2026-75939, affects the `openshift/oc-mirror` tool and has a preliminary CVSS v3. 1 score of 7.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.