Published on September 22, 2026
Red Hat OpenShift Flaw Lets Attackers Bypass Signature Checks and Inject Malicious Release Images
Severity
High
Detail
Red Hat has disclosed a security vulnerability affecting the oc-mirror utility used by OpenShift environments. Tracked as CVE-2026-75939, the vulnerability could allow attackers to bypass release-image signature verification and inject malicious payloads into disconnected registries.
The vulnerability stems from improper verification of PGP-signed OpenShift release images. The oc-mirror utility checks for signature errors before processing the entire signed message body, potentially allowing a specially crafted PGP message with a forged signature to be incorrectly accepted as trusted.
Successful exploitation requires an attacker to intercept or manipulate network traffic between oc-mirror and the release-signature endpoint. The attacker could then provide a malicious release image that appears to be signed with a legitimate Red Hat release key, causing the content to be mirrored into an internal registry and subsequently deployed within the environment.
The vulnerability is particularly significant for disconnected or air-gapped OpenShift deployments, where administrators commonly use oc-mirror to import release images and Operator catalogs into internal registries. Exploitation could result in a software supply-chain compromise, potentially impacting the integrity of deployed applications and infrastructure.
| CVE ID | Summary | CVSS Score |
| CVE-2026-75939 | Improper verification of PGP-signed OpenShift release images in oc-mirror could allow attackers to bypass signature validation and mirror malicious release payloads into disconnected registries. | 7.4 (High) |
Affected Products
The vulnerability affects the following component:
- Red Hat OpenShift Container Platform 4
- openshift4/oc-mirror-plugin-rhel9 (Affected)
The following component is not affected:
- openshift4/oc-mirror-plugin-rhel8 (Component not present)
Recommendation
Organizations should implement the following measures to reduce the risk of exploitation:
- Restrict and closely monitor network connectivity between oc-mirror hosts and external signature retrieval endpoints.
- Review disconnected-registry workflows and validate mirrored release-image digests against trusted values obtained through independent channels.
- Implement network controls to prevent unauthorized interception or manipulation of traffic used for release signature retrieval.
- Review previously mirrored release images and verify their integrity before promoting them to production environments.
- Monitor Red Hat advisories and apply vendor-provided fixes as soon as they become available.
Source