CVE-2026-76139: Inclusion of Functionality from Untrusted Control Sphere in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability CVE-2026-76139 affects the acm-operator-bundle in Red Hat Advanced Cluster Management for Kubernetes 2.11. During the build process, a script is downloaded and run from a remote source without verification of its authenticity or integrity. This flaw enables an attacker to execute malicious code within the build environment, gaining access to sensitive credentials including GitHub access tokens and registry passwords. Exploitation could lead to unauthorized access to build resources and compromise of the operator bundle produced. The CVSS v3.1 score is 8.0 (High), reflecting network attack vector, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Multiple Red Hat security advisories (RHSA-2026:60399 through RHSA-2026:60404) provide updated container images and security fixes addressing this issue.

An attacker exploiting this vulnerability can execute arbitrary code during the build process, leading to unauthorized access to sensitive credentials such as GitHub tokens and registry passwords. This can compromise build resources and the integrity of the operator bundle, potentially allowing further attacks or supply chain compromise. The impact affects confidentiality, integrity, and availability of the build environment and resulting artifacts.

Red Hat has released security advisories (RHSA-2026:60399 through RHSA-2026:60404) providing updated container images and fixes for this vulnerability. Users should apply these official updates to remediate the issue. Ensure all previously released relevant errata are applied before updating. Follow Red Hat's documented procedures for applying these updates as described in their knowledge base article https://access.redhat.com/articles/11258. No additional mitigation is indicated beyond applying the official fixes.