CVE-2026-110522

{}

{}

{}

{"bugzilla": {"description": "oc-mirror: oc-mirror: execution of unsigned opm binary extracted from catalog image in v1 cache rebuild", "id": "2552101", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552101"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-494", "details": ["A flaw was found in oc-mirror's legacy v1 catalog cache rebuild. When the --build-catalog-cache flag is used, oc-mirror extracts an opm binary from the remote operator catalog image and executes it on the host without verifying its signature, digest, or integrity. An attacker who publishes a malicious catalog image to a registry could supply a trojanized opm binary that is executed with the privileges of the user running oc-mirror, resulting in arbitrary code execution on the mirroring host."], "mitigation": {"lang": "en:us", "value": "There is no fix for this vulnerability as the v1 is deprecated and no longer maintained.\nThe recommendation is to use oc-mirror v2 as v1 is end of life."}, "name": "CVE-2026-110522", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/oc-mirror-plugin-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-19T11:19:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110522\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110522\nhttps://github.com/openshift/oc-mirror/blob/main/v1/pkg/cli/mirror/catalog_images.go#L355-L378\nhttps://github.com/openshift/oc-mirror/blob/main/v1/pkg/cli/mirror/catalog_images.go#L428\nhttps://github.com/openshift/oc-mirror/blob/main/v1/pkg/cli/mirror/catalog_images.go#L591-L640"], "statement": "The flaw affects the legacy oc-mirror v1 command-line tool when processing catalogs with the non-default catalog cache regeneration option enabled. Deployments utilizing oc-mirror v2 do not execute binaries from image payloads and are unaffected.\noc-mirror v1 is deprecated since OpenShift 4.18 and currently there is no signature/checksum included in the operator catalog to verify the opm binary. \nThe recommendation is to use oc-mirror v2 as v1 is end of life.", "threat_severity": "Important"}

{"created": "2026-10-20T07:00:13.896385+00:00", "updated": "2026-10-20T07:00:13.896401+00:00", "vendors": []}