Threats Tagged 'cve-2026-76139'

CVE-2026-76139 is a high-severity supply chain vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.11. The acm-operator-bundle build process downloads and executes a script from a remote source without verifying its authenticity, exposing sensitive build credentials such as GitHub tokens and registry passwords. This flaw allows a remote attacker to inject malicious code, potentially compromising build resources and the integrity of the resulting operator bundle. Red Hat has not provided a patch or mitigation that meets their criteria for ease of use and applicability. The vulnerability is rated with a CVSS score of 8.0, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-76139 is a high-severity vulnerability in the acm-operator-bundle component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The build process downloads and executes a script from a remote source without verifying its authenticity or integrity. This allows a remote attacker to inject malicious code, potentially gaining unauthorized access to sensitive build credentials such as GitHub tokens and registry passwords, compromising build resources and the resulting operator bundle.

CVE-2026-76139 is a supply chain vulnerability in the build process of the acm-operator-bundle component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The build process downloads and executes a script from a remote source without verifying its authenticity or integrity, allowing potential execution of malicious code. This script can access sensitive credentials such as GitHub tokens and registry passwords, risking unauthorized access to build resources and compromising the operator bundle's integrity. No official fix or mitigation meeting Red Hat's criteria is currently available.