Critical Red Hat OpenShift Flaw (CVE-2024-XXXX) Lets Attackers Bypass PGP Checks

Key Takeaways

• A critical vulnerability, CVE-2026-75939, has been discovered in Red Hat OpenShift’s oc-mirror tool.
• The flaw allows attackers to bypass PGP signature verification for release images, enabling the injection of malicious software into disconnected OpenShift environments.
• The vulnerability carries a CVSS v3.1 score of 7.4 and is rated “Important” by Red Hat.
• Organizations utilizing oc-mirror, particularly in air-gapped setups, are at risk of supply chain compromise.
• As of the disclosure, no official patch is available; manual mitigation steps are recommended.

Red Hat has issued a disclosure regarding a significant security vulnerability within the OpenShift oc-mirror utility. This flaw, if exploited, could allow malicious actors to circumvent PGP signature verification mechanisms, thereby enabling the introduction of compromised release images into OpenShift environments that operate in a disconnected state.

Designated as CVE-2026-75939, this issue was publicly revealed on September 21, 2026, and boasts a CVSS v3.1 score of 7.4. The affected component is the openshift/oc-mirror tool, which is widely employed by organizations to replicate OpenShift release images, operator catalogs, and associated content into private registries. This functionality is especially crucial for air-gapped or otherwise isolated deployments, where direct access to Red Hat registries or the public internet is restricted.

According to Red Hat, the core problem lies in how oc-mirror processes PGP-signed release image signatures. The tool performs signature error checks prematurely, before the entire signed message body has been fully processed. This operational sequence creates a scenario where a meticulously crafted PGP message could appear legitimate, despite its signature being fabricated.

Red Hat OpenShift Flaw Details

Successful exploitation of this vulnerability would necessitate an attacker’s ability to intercept or modify network traffic between the vulnerable oc-mirror instance and the signature verification endpoint. The attacker could then introduce a forged PGP message containing a valid Red Hat release key ID. Due to the faulty validation process, the oc-mirror tool could mistakenly accept this malicious message as authentic, subsequently mirroring a hostile release payload into a private, disconnected registry.

This scenario poses a severe supply chain risk, given that content mirrored into private registries is typically regarded as approved, internally vetted software. Once a malicious release image infiltrates a private registry, OpenShift administrators or automated deployment pipelines could inadvertently select it for installation. This could lead to unauthorized code execution within clusters, application tampering, credential theft, or unauthorized data access.

Red Hat has categorized the vulnerability as “Important” and identified its attack vector as network-based. Exploitation does not require attacker privileges or user interaction. However, the complexity of the attack is rated as high, as it requires the attacker to successfully manipulate signature-related network traffic. The CVSS vector provided by Red Hat indicates a high impact on confidentiality and integrity, with no impact on availability.

The specific component affected is openshift4/oc-mirror-plugin-rhel9 within Red Hat OpenShift Container Platform 4. It’s important to note that the RHEL 8 version of this plugin is not impacted, as the component is absent from that release. Red Hat noted that older package versions within affected minor product streams should generally be presumed vulnerable unless explicitly stated otherwise.

At the time of public disclosure, Red Hat stated that no practical mitigation strategy met its standards for broad deployment and stability. Consequently, organizations relying on oc-mirror should consider their release-mirroring workflows to be high-risk until official security errata or updated packages become available.

What You Should Do

• Restrict network access to signature endpoints for oc-mirror instances.
• Implement and carefully manage TLS inspection safeguards for relevant network traffic.
• Actively monitor for any unusual or unauthorized changes in mirrored registry content.
• Independently validate release digests through trusted, out-of-band channels before promoting mirrored content into production environments.
• Conduct a thorough review of access controls for all disconnected registries.
• Audit all recently mirrored releases for any signs of compromise.
• Regularly consult Red Hat’s security advisories for updates on remediation and patching.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.