CVE-2026-75939 Red Hat CVE debrief

Who should care

Red Hat OpenShift Container Platform 4.18 administrators and users, as well as developers and security teams responsible for software deployment and vulnerability management, should be aware of this vulnerability and take action to verify the implementation of PGP release image signature verification in openshift/oc-mirror. They should also validate software deployment integrity and review affected versions and packages according to Red Hat advisories and

Why it matters

CVE-2026-75939 allows a remote attacker to bypass PGP release image signature verification in openshift/oc-mirror, potentially compromising software deployment integrity. Red Hat OpenShift Container Platform 4.18 administrators and users should verify signature verification implementation and validate software deployment integrity.

• Compromised software deployment integrity due to bypassed PGP signature verification
• Potential for malicious release payloads in disconnected registries
• Need for verification of affected versions and packages
• High priority for validating software deployment integrity

Technical summary

The openshift/oc-mirror tool incorrectly verifies PGP release image signatures by checking for signature errors before processing the entire signed body. This allows a remote attacker to bypass signature verification and potentially compromise software deployment integrity. The vulnerability can be exploited by crafting a PGP message with a valid Red Hat release key ID but a forged signature, enabling the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry. To address this vulnerability, it is essential to verify the implementation of PGP release image signature verification in openshift/oc-mirror and validate software deployment integrity.

Defensive priority

High priority for verifying signature verification implementation and validating software deployment integrity.

Recommended defensive actions

• Verify the implementation of PGP release image signature verification in openshift/oc-mirror according to Red Hat's documentation and guidelines.
• Validate software deployment integrity in Red Hat OpenShift Container Platform 4.18 by reviewing deployment logs and monitoring for suspicious activity.
• Review and update affected versions and packages according to Red Hat advisories and patch management processes.
• Perform an exposure review to identify potentially vulnerable deployments and prioritize remediation efforts.
• Implement compensating controls, such as additional monitoring or access controls, for exposed systems while remediation is scheduled and verified.
• Conduct an asset inventory to ensure all affected systems are accounted for and included in remediation efforts.
• Track exceptions, retest remediated assets, and close the item only after evidence of successful remediation is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in openshift/oc-mirror, including its impact on software deployment integrity. However, affected versions, patches, and detailed remediation steps require verification from official sources like Red Hat. The vulnerability allows a remote attacker to bypass PGP release image signature verification, potentially leading to the deployment of malicious software. To verify the implementation of PGP release image signature verification and validate software deployment

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.