CVE-2026-87057

medium Red Hat
CVSS v3 Base Score
4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Published: September 8, 2026 (2 days ago)
Last Modified: September 8, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introduction of malicious code or unexpected changes in the build process. An attacker could exploit this to compromise the integrity of the software supply chain.

CWE

CWE-829

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov