Loading story…
Red Hat disclosed CVE-2026-75939, an Important-severity flaw in the openshift4/oc-mirror-plugin-rhel9 component of OpenShift Container Platform 4. The oc-mirror tool can incorrectly accept a forged PGP-signed release message because it checks signature errors before processing the complete signed message; a crafted message using a valid Red Hat release-key ID can therefore appear trusted.
An attacker able to intercept or modify traffic between oc-mirror and its signature endpoint could exploit the issue to mirror malicious release images into disconnected OpenShift registries. The vulnerability has a CVSS v3.1 score of 7.4, requires no privileges or user interaction, but has high attack complexity due to the required network-position capability; Red Hat reported no practical mitigation meeting its deployment and stability criteria at disclosure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Red Hat disclosed CVE-2026-75939, an Important-severity vulnerability (CVSS 7.4) in the OpenShift oc-mirror tool. The flaw can let an attacker who intercepts or modifies signature-related traffic bypass PGP verification and cause malicious release images to be mirrored into disconnected registries; no practical mitigation meeting Red Hat's criteria was available at disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities warned that **Red Hat OpenShift Container Platform 4** contains two high-severity vulnerabilities that can lead to code execution and node takeover in enterprise container environments. `CVE-2024-45496` in `ose-openshift-controller-manager-container` carries a **CVSS 9.9** rating and can allow arbitrary code execution on an OpenShift node when a user with developer-level access exploits insufficient restrictions on elevated privileges. `CVE-2024-7387` in `openshift4/ose-docker-builder`, rated **CVSS 9.1**, can enable arbitrary command execution on an OpenShift node and may allow privilege escalation and full control of the affected node. At the time of the alert, mitigations were available but vendor patches had not yet been released. A separate alert highlighted the **regreSSHion** flaw in **OpenSSH**, which can give an attacker unrestricted root-level access on vulnerable Linux and FreeBSD-based systems. The issue affects OpenSSH versions from `8.5p1` up to but not including `9.8p1`, as well as versions earlier than `4.4p1`; OpenBSD-based systems were reported as not vulnerable. Successful exploitation has been confirmed on systems using **glibc**, while systems using **musl libc** were reported as not vulnerable, and the attack currently requires repeated attempts over hours or days. A fix is available in **OpenSSH `9.8p1`**, though some distributors have backported the patch, meaning package version numbers alone may not reliably indicate exposure.
Jun 29, 2026
Red Hat released Important security updates for Red Hat OpenShift Container Platform and RHEL 9 Podman and Buildah deployments to remediate container-stack vulnerabilities, notably **CVE-2024-9675** and **CVE-2024-9676**. CVE-2024-9675 can permit arbitrary directory mounts through Buildah, while CVE-2024-9676 is a `containers/storage` symlink-traversal flaw affecting Podman, Buildah, and CRI-O. When a malicious image runs with automatically assigned user namespaces, the latter can cause container creation to block indefinitely or CRI-O to exhaust memory and crash; limited error-message disclosure is also possible to the user operating the affected software. Affected OpenShift releases include 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, and 4.18, with related advisories also addressing flaws such as Dockerfile bind-propagation validation, FIPS crypto-policy mounting, Distribution JWT signing-key injection, and denial-of-service issues in Go, BIND, libxml2, GRUB2, and the Linux kernel. Red Hat advises OpenShift customers to update clusters through their supported release channels using the CLI or web console, and RHEL 9 users to deploy the updated Podman or Buildah packages for their supported architecture and subscription channel.
Aug 26, 2026
Red Hat issued security updates across OpenShift Container Platform (OCP), OpenShift API for Data Protection (OADP), Migration Toolkit for Containers, OpenShift Logging, and OpenShift Virtualization to remediate denial-of-service, memory-consumption, argument-injection, information-disclosure, and authorization-bypass risks. A recurring issue is `CVE-2024-45338` in `golang.org/x/net/html`, whose non-linear parsing behavior can enable denial of service; it was addressed in OCP 4.17.16, OADP 1.3.7, OpenShift Logging 6.0.6, OpenShift Virtualization 4.16.7, and MTC 1.8.7. OCP 4.16.23 and 4.17.3 also fixed `CVE-2024-24786`, in which malformed JSON can cause an infinite loop in `golang-protobuf` processing. OADP 1.4.5 additionally remediates Go-library flaws that could permit authorization bypass, HTTP request smuggling, memory-exhaustion denial of service, SSH key-exchange denial of service, and go-git argument injection. The go-git issue, `CVE-2025-21613`, affects versions before 5.13.0 when the file transport shells out to Git binaries and can allow attacker-controlled `git-upload-pack` flags. Red Hat directs affected administrators to apply prerequisite errata and upgrade through the appropriate OpenShift release channel or product-specific update procedures across supported RHEL 8 and RHEL 9 architectures.
Aug 28, 2026