CVE-2026-96577
HighCVSS 7.1Summary
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
Risk Assessment
The risk includes compromise of container image integrity, data loss, or unauthorized access to mirrored content, potentially leading to attacks on production environments.
Recommendation
Configure oc-mirror so that the local registry is only accessible from the local system, and enable authentication and encryption for the registry.
Other vulnerabilities in oc-mirror
See all- CVE-2026-101295High
Path traversal / arbitrary file write vulnerability in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.
- CVE-2026-75939High
In openshift/oc-mirror, the tool incorrectly verifies PGP release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could craft a PGP message with a valid Red Hat release key ID but a forged signature, enabling the oc-mirror tool to accept and mirror a malicious release payload into a disconnected registry.
Original NVD description (English source)
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS