CVE-2026-87055

{}

{}

{}

{"bugzilla": {"description": "operator-sdk-builder: operator-sdk-builder: Base image referenced by mutable tag rather than sha256 digest", "id": "2530046", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530046"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce vulnerabilities or malicious code into the build process, posing a supply chain integrity risk."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that the `FROM` line in the `Containerfile` references the base image using an immutable SHA256 digest instead of a mutable tag. For example, update the `FROM` line to `FROM registry.access.redhat.com/ubi9/go-toolset:1.25.5-1770654497@sha256:<digest>`. This practice ensures that the base image remains consistent across builds, improving build integrity. This change requires modifying the `Containerfile` and rebuilding the image."}, "name": "CVE-2026-87055", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87055\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87055"], "statement": "This issue has a Low impact as it primarily affects the integrity of the build process rather than introducing a runtime vulnerability in deployed applications. Referencing base images with mutable tags can lead to inconsistent builds if the underlying image changes, potentially introducing unexpected behavior or dependencies.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "operator-sdk-builder", "vendor": "operator-sdk-builder"}], "created": "2026-09-09T07:00:09.235945+00:00", "updated": "2026-11-09T21:15:13.774070+00:00", "vendors": ["operator-sdk-builder", "operator-sdk-builder$PRODUCT$operator-sdk-builder"]}