CVE-2026-87060

{}

{}

{}

{"bugzilla": {"description": "olm-operator-konflux-sample: olm-operator-konflux-sample: Renovate automerge enabled with base-image update exclusions", "id": "2530057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530057"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-1357", "details": ["A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, configure Renovate to scope automerge to low-risk update types only, such as `packageRules` with `matchUpdateTypes: [\"digest\"]`. Alternatively, set `automerge: false` and implement required-review branch protection. Additionally, remove the exclusion for `ose-operator-registry` to ensure the catalog base image is tracked for updates. These changes should be applied to the Renovate configuration within the `olm-operator-konflux-sample` component. A restart or reload of the Renovate process may be required for the changes to take effect."}, "name": "CVE-2026-87060", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87060\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87060"], "statement": "This issue has a Low impact as it pertains to the configuration of Renovate automerge within the `olm-operator-konflux-sample` component of Konflux. The broad enablement of automerge, coupled with the exclusion of the `ose-operator-registry` base image from tracking, creates an inconsistent update posture that could lead to outdated dependencies rather than direct exploitation.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "olm-operator-konflux-sample", "vendor": "olm-operator-konflux-sample"}], "created": "2026-09-09T07:00:09.235541+00:00", "updated": "2026-11-10T08:30:23.038966+00:00", "vendors": ["olm-operator-konflux-sample", "olm-operator-konflux-sample$PRODUCT$olm-operator-konflux-sample"]}