Red Hat OpenShift Flaw Lets Attackers Bypass PGP Checks and Push Malicious Releases
Red Hat OpenShift oc-mirror can accept forged PGP signatures, letting attackers mirror malicious release images into disconnected registries.
Red Hat disclosed CVE-2026-75939, a CVSS 7.4 flaw in the OpenShift oc-mirror plugin for RHEL 9. The tool checks PGP signature errors before finishing the signed message, so a forged message carrying a valid Red Hat release key ID can be accepted. An attacker who can alter traffic to the signature endpoint could mirror a malicious release image into a disconnected registry. No mitigation met Red Hat’s criteria at the September 21, 2026 disclosure, and the RHEL 8 plugin is not affected.
- CVE-2026-75939 scores CVSS 7.4 and affects OpenShift oc-mirror on RHEL 9.
- Validation checks signature errors before the full signed body is processed.
- Exploitation needs manipulated traffic to the signature endpoint and has high complexity.
- Red Hat had no stable mitigation and had not issued errata at disclosure.
- CVEs
- CVE-2026-75939
- Vendors
- Red Hat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75939 | PGP Signature Verification Bypass in OpenShift oc-mirror | 7.4 | — |
From the original article
2 min read at cybersecuritynews.com
Red Hat has disclosed an Important security vulnerability in the OpenShift oc-mirror tool that could allow attackers to bypass PGP signature verification and introduce malicious release images into disconnected OpenShift environments. Tracked as CVE-2026-75939, the issue carries a CVSS v3. 1 score of 7.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.