Arbitrary Code Execution Vulnerability in Kube-Compare by Red Hat
CVE-2026-87114

7.1HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4.19
Red Hat Openshift Container Platform 4.20
Red Hat Openshift Container Platform 4.21
Red Hat Openshift Container Platform 4.22
Vendor
CVE Published:
28 September 2026

What is CVE-2026-87114?

A vulnerability in Kube-Compare allows attackers to exploit untrusted container images by executing their entrypoints instead of just extracting data from stopped containers. This could lead to arbitrary code execution on an operator's workstation, especially if the Docker daemon runs with elevated privileges, potentially granting the untrusted code root access. This poses significant security threats to users and their environments.

Affected Version(s)

Red Hat OpenShift Container Platform 4.19 1790632105

Red Hat OpenShift Container Platform 4.20 1790707563

Red Hat OpenShift Container Platform 4.21 1790707362

References

https://access.redhat.com/errata/RHSA-2026:74381
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:74384
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:74430
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.