CVE-2026-75939

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 (affected versions not specified)

Description A flaw in the oc-mirror tool allows for the bypass of PGP (Pretty Good Privacy) release image signature verification. The tool incorrectly checks for signature errors before the entire signed body is processed. A remote attacker capable of intercepting or manipulating network traffic to the signature endpoint can craft a PGP message that uses a valid Red Hat release key ID but contains a forged signature. This allows the oc-mirror tool to accept and mirror a malicious release payload into a disconnected registry, compromising the integrity of software deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.