CVE-2026-87054

medium Red Hat
CVSS v3 Base Score
4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Published: September 8, 2026 (2 days ago)
Last Modified: September 8, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted registries, which could allow for the use of untrusted or malicious container images.

CWE

CWE-345

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov