CVE-2026-75939 - Signature Verification Bypass in Red Hat oc-mirror

CVE-2026-75939 involves a critical logic vulnerability in the oc-mirror tool, which is used to manage disconnected OpenShift environments. The tool incorrectly verifies PGP release image signatures by executing signature error checks before the entire signed body is fully processed. This premature validation allows a remote attacker, capable of intercepting or manipulating network traffic (e.g., via Man-in-the-Middle techniques), to present a PGP message that contains a valid Red Hat release key ID but a forged signature body. Because the tool fails to validate the entire payload, it accepts the tampered release as legitimate. This vulnerability significantly impacts the software supply chain integrity by allowing the mirroring of malicious container images into internal, disconnected enterprise registries, where they may later be deployed into production clusters.

Impact

The vulnerability allows for the unauthorized injection of malicious software components into isolated container registries. If exploited, an attacker can compromise the integrity of software deployments within an organization's internal infrastructure, potentially leading to arbitrary code execution across clusters that rely on the compromised mirror as a trusted source of truth.

Recommendation

• Monitor for unauthorized or unexpected modifications to release image signatures or payloads being mirrored into disconnected registries.
• Implement and enforce strict TLS validation for all network connections involved in the image mirroring process to mitigate potential interception of signature endpoints.
• Patch the oc-mirror tool immediately once an official update is provided by Red Hat to address the signature verification logic flaw.
• Audit internal container registry logs for image layers that originated from unexpected network sources or that lack valid, verifiable cryptographic signatures.