Signature Verification Bypass in OpenShift by Red Hat
CVE-2026-75939

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4
Vendor
CVE Published:
21 September 2026

What is CVE-2026-75939?

A flaw has been identified in the OpenShift oc-mirror tool where it improperly verifies PGP signatures on released images. The issue arises from the premature verification of signatures, allowing an attacker to bypass checks by intercepting or manipulating network traffic. This can lead to the acceptance of a forged signature that appears valid due to a legitimate Red Hat release key ID, enabling the injection of a malicious release payload into a disconnected registry. As a result, it poses a significant risk to the integrity of software deployments.

References

https://access.redhat.com/security/cve/CVE-2026-75939
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2517976
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.