Threats Tagged 'cve-2026-75569'

CVE-2026-75569 is a high-severity vulnerability in the Red Hat multicluster engine for Kubernetes 2.10. The issue arises from the build process of the mce-operator-bundle, which fetches and executes scripts from a remote repository without verifying their integrity. This lack of commit pinning or signature verification allows an attacker with write access to the remote repository to inject arbitrary code, potentially compromising the build process and leading to distribution of malicious software.

CVE-2026-75569 is a supply chain vulnerability in the multicluster engine for Kubernetes (mce-operator-bundle) where the build process fetches and executes scripts from a remote repository without integrity checks. This allows a malicious actor with write access to the remote repository to inject arbitrary code during the build, potentially compromising the build process and the integrity of distributed software. The vulnerability affects versions prior to 2.9.7 and 2.10.6. There are no direct runtime mitigations since the issue is in the build-time process. Red Hat has released updated images in version 2.9.7 to address this issue.

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.