Red Hat recently revealed a significant security vulnerability in the OpenShift oc-mirror tool, identified as CVE-2026-75939, with a CVSS score of 7.4. This flaw, disclosed on September 21, 2026, could enable attackers to bypass PGP signature checks, allowing them to introduce harmful release images into isolated OpenShift setups.
Impact on Disconnected Environments
The vulnerability affects the openshift/oc-mirror component, used by organizations for copying OpenShift release images and operator catalogs to private registries, crucial for air-gapped or disconnected deployments. These setups cannot access software directly from Red Hat or the public internet due to isolation requirements.
Red Hat’s disclosure indicates that oc-mirror fails to accurately validate PGP-signed release image signatures, evaluating signature errors prematurely before processing the complete signed message body. This oversight could allow a crafted PGP message to bypass verification, even if its signature is fake.
Potential Risks and Attack Vectors
For exploitation, an attacker must intercept or alter traffic between the affected oc-mirror instance and the signature endpoint. By presenting a forged PGP message with a valid release key ID, the malicious payload might be mistakenly accepted by the system as legitimate.
Such a scenario poses a significant supply chain threat, as mirrored content is typically considered trusted internal software. Once a malicious release image is stored in the private registry, it may be chosen for deployment, risking unauthorized code execution or data breaches.
Security Measures and Recommendations
Red Hat categorizes this issue as Important, highlighting its network attack vector. The vulnerability doesn’t require user interaction or special privileges, but its exploitation is complex due to necessary manipulation of network traffic concerning signature verification.
The affected component is specific to openshift4/oc-mirror-plugin-rhel9 in Red Hat OpenShift Container Platform 4, with RHEL 8 unaffected. Red Hat advises caution with older package versions in vulnerable product lines unless explicitly noted as secure.
In response, administrators should enhance network restrictions to signature endpoints, enforce TLS inspection, and rigorously validate release digests independently before production deployment. Monitoring for irregularities in mirrored content and reviewing recent releases are also crucial steps.
Organizations should stay updated with Red Hat’s security advisories for potential remediations and maintain vigilant security practices to mitigate risks associated with this vulnerability.
