CVE-2026-96577 in Assisted Installer for OpenShift Container Platform
Summary
by MITRE • 10/01/2026
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in oc-mirror represents a critical misconfiguration within its embedded registry component during mirroring operations. The core technical flaw lies in the binding mechanism of the local cache registry, which is configured to listen on all network interfaces rather than being restricted exclusively to the localhost interface. This configuration error effectively exposes the internal management endpoints and data storage mechanisms of the mirror process to any network segment that can reach the host machine. By failing to enforce a loopback-only binding or implementing proper access control lists at the network level, the service inadvertently creates an open door for external interaction with what was intended to be a local, ephemeral caching layer used solely for facilitating offline image transfers.
From an operational security perspective, this exposure allows unauthenticated actors on adjacent networks to interact directly with the registry API. The lack of authentication means that any user or automated tool within network reach can issue commands without providing credentials. This leads to several severe consequences including the ability to push tampered container images into the cache, which could then be propagated if the mirroring process is subsequently used to update a target environment. Furthermore, attackers can delete cached images, causing denial of service conditions for legitimate mirroring tasks by removing necessary dependencies or base layers required for successful image replication. Additionally, the attacker gains read access to mirrored content, potentially exposing sensitive application binaries and configuration data contained within those containers to unauthorized parties.
This vulnerability aligns with CWE-284 Improper Access Control as it involves a failure to restrict access to resources based on user identity or network location. It also maps to ATT&CK technique T1078 Valid Accounts if the attacker leverages default credentials, though in this specific case, the absence of authentication requirements makes it more akin to direct exploitation of exposed services similar to CWE-295 Improper Certificate Validation when considering potential future encryption needs or simply CWE-446 Unprotected Admin Interface. The impact extends beyond simple data leakage; by injecting malicious images into the cache, an attacker can compromise the integrity of downstream systems that rely on oc-mirror for air-gapped deployments, effectively bypassing security boundaries designed to protect isolated environments.
Mitigation strategies must focus on network isolation and configuration hardening. Administrators should ensure that the host firewall rules explicitly block all inbound traffic to the ports used by the embedded registry from any interface other than localhost. If possible, updating oc-mirror to a version where this binding behavior is corrected or configurable via secure defaults is essential. In environments where such exposure cannot be immediately patched, implementing network segmentation to isolate management interfaces and ensuring that mirroring operations are conducted in strictly controlled, non-routable network zones will significantly reduce the attack surface. Regular auditing of listening services using tools like netstat or ss can help detect unintended bindings before they are exploited by malicious actors seeking to disrupt supply chain integrity through container image tampering.