Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-87056

operator-sdk-builder: operator-sdk-builder: No automated dependency-update configuration for submodules or Containerfile

A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Operator-sdk-builder
Products
Operator-sdk-builder
CVE-2026-87053

operator-sdk-builder: operator-sdk-builder: Final container image runs as root (USER root never reverted)

A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a malicious actor compromises the container, they could leverage these root privileges to perform unauthorized actions, potentially leading to a broader system compromise.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
Operator-sdk-builder
Products
Operator-sdk-builder
CVE-2026-87055

operator-sdk-builder: operator-sdk-builder: Base image referenced by mutable tag rather than sha256 digest

A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce vulnerabilities or malicious code into the build process, posing a supply chain integrity risk.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Operator-sdk-builder
Products
Operator-sdk-builder
CVE-2026-87054

operator-sdk-builder: operator-sdk-builder: containers-policy.json defaults to insecureAcceptAnything for non-Red Hat registries

A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted registries, which could allow for the use of untrusted or malicious container images.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
Operator-sdk-builder
Products
Operator-sdk-builder