Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by redhat

CVE-2026-87114Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

High 7.1

In plain English

A high-severity security flaw in Pen Drive Powered by Red Hat Lightspeed from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.20 see references
Red Hat Red Hat OpenShift Container Platform 4.21 see references
Red Hat Red Hat OpenShift Container Platform 4.22 see references
Red Hat Pen Drive Powered by Red Hat Lightspeed see references

Weakness: CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References