CVE-2026-75939

Description

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: HIGH
CVSS score: 7.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Effective score: 7.4 / 10 HIGH source: CNA overview
CWE(s): CWE-347
Reserved: 2026-08-18
Published: 2026-09-21 14:05 UTC
Last updated: 2026-09-21 14:05 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75939.json
Linked Threat: CVE-2026-75939 — Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 15:17:31 UTC
NVD last modified: 2026-09-21 15:17:31 UTC
NVD CVSS v3.1: 7.4 / 10 HIGH source: secalert@redhat.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability subscore: 2.2 / 10
Impact subscore: 5.2 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-83918
Assigner: redhat
Published: Sep 21, 2026, 2:05:10 PM
Updated: Sep 21, 2026, 2:05:10 PM
EUVD base score (CVSS 3.1): 7.4 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0000
Aliases: GHSA-vhqx-cfmx-mjq9

ENISA description: A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

EUVD references (2)

Affected products (2)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://access.redhat.com/security/cve/CVE-2026-75939 vdb-entryx_refsource_REDHAT
RHBZ#2517976 issue-trackingx_refsource_REDHAT

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://access.redhat.com/security/cve/CVE-2026-75939 secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2517976 secalert@redhat.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-75939 - Red Hat Customer Portal

web:access.redhat.com

Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

2026-09-22 16:47 UTC
CVE-2026-75939 - Vulnerability Details - OpenCVE

web:app.opencve.io

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

2026-09-22 16:47 UTC
CVE-2026-75939: Red Hat Vulnerability (CVSS 7.4) | CVETodo

web:cvetodo.com

CVE-2026-75939 is a CVSS 7.4 high-severity vulnerability in Red Hat products. Includes technical details, affected versions, and mitigation steps.

2026-09-22 16:47 UTC
Red Hat OpenShift Flaw Lets Attackers Bypass Signature Checks and ...

web:cyberpress.org

Red Hat has disclosed an Important OpenShift vulnerability that could allow attackers to bypass release-image signature verification and insert malicious payloads into disconnected registries. Tracked as CVE-2026-75939 , the issue affects the oc-mirror utility and carries a CVSS v3.1 score of 7.4 ...

2026-09-22 16:47 UTC
CVE-2026-75939 - Exploits & Severity - Feedly

web:feedly.com

Timeline Highlight events Vendor advisory RedHat CVE advisory released a security advisory ( CVE-2026-75939 ).

2026-09-22 16:47 UTC
CVE-2026-75939: Red Hat Red Hat OpenShift Container Platform 4…

web:security.glexia.com

CVE-2026-75939 is a High severity, CVSS 7.4. Affecting Red Hat Red Hat OpenShift Container Platform 4. Review impact, affected versions, remediation priorities,…

2026-09-22 16:47 UTC
CVE-2026-75939 - OpenShift OC-Mirror PGP Signature…

web:vulmon.com

Vulnerability Summary A bypass of PGP signature verification in openshift/oc-mirror enables remote attackers to mirror malicious release payloads into disconnected registries. The tool incorrectly checks for signature errors before processing the entire signed body. Attackers can intercept network traffic to the signature endpoint and use a valid Red Hat release key ID with a forged signature ...

2026-09-22 16:47 UTC
CVE-2026-75939 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-75939 🗓️ 21 Sep 2026 07:05:10 Reported by redhat Type cve 🔗 web.nvd.nist.gov 👁 9 Views

2026-09-22 16:47 UTC
CVE-2026-75939: Red Hat Red Hat OpenShift Container Platform 4 ... - Rapid7

web:www.rapid7.com

CVE-2026-75939 : Red Hat Red Hat OpenShift Container Platform 4: A flaw was found in openshift/oc-mirror. View severity, references, and remediation details from Rapid7.

2026-09-22 16:47 UTC
CVE-2026-75939 | Tenable®

web:www.tenable.com

This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments. References https://bugzilla.redhat.com/show_bug.cgi?id=2517976 https://access.redhat.com/security/ cve / CVE - 2026 - 75939

2026-09-22 16:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-75939.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/oc-mirror-plugin-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/oc-mirror-plugin-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-09-21T13:27:53.361Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T14:05:10.429Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-75939"
        },
        {
          "name": "RHBZ#2517976",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517976"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-17T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-21T13:27:53.361Z",
          "value": "Made public."
        }
      ],
      "title": "Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-75939",
    "datePublished": "2026-09-21T14:05:10.429Z",
    "dateReserved": "2026-08-18T15:55:39.041Z",
    "dateUpdated": "2026-09-21T14:05:10.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}