CVE-2026-87114 is a vulnerability in kube-compare where processing a 'container://' reference path causes the tool to execute the entrypoint of an untrusted container image rather than only extracting data from a stopped container. This behavior enables a remote attacker to execute arbitrary code on the operator's workstation. If the Docker daemon is configured to require sudo for access, the malicious code may run with root-mediated privileges, increasing the security risk. The vulnerability is specific to environments where kube-compare interacts with Docker requiring elevated permissions.

An attacker can achieve arbitrary code execution on the operator's workstation by supplying a malicious container image reference. If Docker daemon access requires sudo, the attacker's code may execute with root-level privileges, posing a significant confidentiality and integrity risk. There is no impact on availability reported.

Users should ensure that container images referenced via the 'container://' scheme are from trusted sources and avoid untrusted or unverified images. If Docker requires sudo for daemon access, review and restrict sudo policies to limit Docker command execution to trusted users and contexts. No official patch or fix is explicitly stated in the advisory; therefore, these mitigations are the primary recommended actions.