Vulnerability · Published Sep 21, 2026 · Assigned by redhat

CVE-2026-75939Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

High 7.4

In plain English

A high-severity security flaw in Red Hat OpenShift Container Platform 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 68.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4	see references
Red Hat	Red Hat OpenShift Container Platform 5	see references
Red Hat	Red Hat OpenShift Container Platform 5	see references

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

RHSA-2026:79039 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-75939 vdb-entry, x_refsource_REDHAT
RHBZ#2517976 issue-tracking, x_refsource_REDHAT