Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-87060

olm-operator-konflux-sample: olm-operator-konflux-sample: Renovate automerge enabled with base-image update exclusions

A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-87059

olm-operator-konflux-sample: olm-operator-konflux-sample: Unpinned pip dependency installation in bundle builder stage

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-87058

olm-operator-konflux-sample: olm-operator-konflux-sample: Hermetic build disabled by default; bundle build performs live network fetches

A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthiness of the resulting software artifacts. This introduces a supply chain risk where the final product might contain unintended or malicious code.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-87057

olm-operator-konflux-sample: olm-operator-konflux-sample: Runtime base images referenced by mutable floating tags

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introduction of malicious code or unexpected changes in the build process. An attacker could exploit this to compromise the integrity of the software supply chain.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-87061

olm-operator-konflux-sample: olm-operator-konflux-sample: bundle-hack/update_bundle.sh lacks fail-fast shell options

A flaw was found in olm-operator-konflux-sample. The `bundle-hack/update_bundle.sh` script lacks mechanisms to stop execution immediately upon encountering an error. This oversight allows critical data processing steps, such as those involving `skopeo` or `jq` commands, to fail silently and proceed with outdated or incomplete information. Consequently, this could lead to data integrity issues within the system.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample