CVE-2026-87056

{}

{}

{}

{"bugzilla": {"description": "operator-sdk-builder: operator-sdk-builder: No automated dependency-update configuration for submodules or Containerfile", "id": "2530047", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530047"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-1104", "details": ["A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures."], "mitigation": {"lang": "en:us", "value": "To mitigate the risk of stale or vulnerable dependencies, configure automated dependency updates for the `operator-sdk-builder` component. This can be achieved by adding a `renovate.json` file or enabling Konflux MintMaker rules to cover `git-submodules`, `dockerfile`, and `tekton` managers. Implementing these configurations will ensure that submodule SHAs and base-image digests receive automated update pull requests, proactively addressing potential future vulnerabilities."}, "name": "CVE-2026-87056", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87056\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87056"], "statement": "This issue has a Low impact as it describes the absence of automated dependency update configurations within the `operator-sdk-builder` component of Konflux CI. This lack of automation means that stale or vulnerable dependencies may not be automatically identified, increasing the risk of introducing security flaws if not manually managed. It does not represent an immediately exploitable vulnerability in deployed Red Hat products but rather a preventative measure for development practices.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "operator-sdk-builder", "vendor": "operator-sdk-builder"}], "created": "2026-09-09T07:30:06.334453+00:00", "updated": "2026-11-10T08:30:23.040152+00:00", "vendors": ["operator-sdk-builder", "operator-sdk-builder$PRODUCT$operator-sdk-builder"]}