CVE-2026-75939 | BDVDB-2026-377396 Detail

Description#

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-21Record published in the CVE List.
2. Version 22026-11-06Most recent update recorded in the CVE List.