PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96577 Red Hat CVE debrief

A flaw in oc-mirror allows an unauthenticated attacker on an adjacent network to push tampered container images, delete cached images, or access mirrored content due to the embedded local cache registry binding to all network interfaces without authentication or encryption. This vulnerability impacts Red Hat OpenShift Container Platform 4.18, 4.19, 4.20, 4.21, and 4.22, and Assisted Installer for Red Hat OpenShift Container Platform 2. Defenders should assess exposure and apply mitigations.

Vendor
Red Hat
Product
Red Hat OpenShift Container Platform
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-01
Original CVE updated
2026-10-15
Advisory published
2026-10-01
Advisory updated
2026-10-15

Who should care

Defenders responsible for Red Hat OpenShift Container Platform 4.18, 4.19, 4.20, 4.21, and 4.22, and Assisted Installer for Red Hat OpenShift Container Platform 2 should assess exposure and apply mitigations.

Why it matters

CVE-2026-96577 is a high-severity vulnerability in oc-mirror that allows an unauthenticated attacker to push tampered container images, delete cached images, or access mirrored content. Defenders should prioritize verifying exposure and applying mitigations.

  • Verify exposure of oc-mirror in the environment
  • Apply vendor-provided patches or mitigations
  • Restrict access to the oc-mirror service
  • Monitor for suspicious activity related to oc-mirror

Technical summary

The oc-mirror tool has a flaw where the embedded local cache registry binds to all network interfaces without authentication or encryption. This allows an unauthenticated attacker on an adjacent network to connect to the exposed service and push tampered container images, delete cached images, or access mirrored content. The vulnerability affects Red Hat OpenShift Container Platform 4.18, 4.19, 4.20, 4.21, and 4.22, and Assisted Installer for Red Hat OpenShift Container Platform 2. Defenders should prioritize verifying exposure of oc-mirror in their environment and apply vendor-provided patches or mitigations.

Defensive priority

Defenders should prioritize verifying exposure of oc-mirror in their environment, especially in Red Hat OpenShift Container Platform 4.18, 4.19, 4.20, 4.21, and 4.22, and Assisted Installer for Red Hat OpenShift Container Platform 2, and apply vendor-provided patches or mitigations.

Recommended defensive actions

  • Verify exposure of oc-mirror in the environment
  • Apply vendor-provided patches or mitigations
  • Restrict access to the oc-mirror service
  • Monitor for suspicious activity related to oc-mirror
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Red Hat has provided several errata related to this vulnerability, including RHSA-2026:74380, RHSA-2026:74383, RHSA-2026:74429, RHSA-2026:74434, and RHSA-2026:79039.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96577 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96577

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96577 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96577

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authent

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96577.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:74380

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:74383

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:74429

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:74434

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:79039

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-96577

    Supplemental source - vdb-entry, x_refsource_REDHAT

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.