OpenShift oc-mirror CVE-2026-75939 can poison disconnected registries

CVE-2026-75939 lets RHEL 9 OpenShift oc-mirror accept forged PGP signatures and mirror malicious releases into disconnected registries; no errata yet.

Red Hat disclosed CVE-2026-75939, an important flaw in the OpenShift oc-mirror plugin for RHEL 9, scored CVSS v3.1 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). GBHackers calls that score preliminary, while Cyber Security News reports 7.4 without that qualifier. Both say the tool checks PGP signature errors before finishing the signed body, so a forged message that still cites a valid Red Hat release key can be treated as trusted. An attacker who can tamper with or alter traffic to the signature endpoint—no privileges required, but high complexity—could mirror malicious release images into a disconnected registry as trusted content. The RHEL 8 plugin is not affected. At the September 21, 2026 disclosure, Red Hat had not issued a security erratum, and both outlets say no mitigation met Red Hat’s criteria.

• CVE-2026-75939 is an important flaw in the OpenShift oc-mirror plugin on RHEL 9; both reports say the RHEL 8 plugin is unaffected.
• CVSS v3.1 is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). GBHackers calls the score preliminary; Cyber Security News does not.
• The plugin checks PGP signature errors before processing the full signed body, so a forged message that still references a valid Red Hat release key can be accepted.
• Exploitation needs tampering with or altered traffic to the signature endpoint, requires no privileges, and is high complexity.
• Mirrored release images can then enter a disconnected registry as trusted content.
• As of the September 21, 2026 disclosure, Red Hat had issued no security erratum, and both reports say no mitigation met Red Hat’s criteria.