Red Hat OpenShift Container Platform PGP Signature Verification signature verification

Summaryinfo

A vulnerability identified as critical has been detected in Red Hat OpenShift Container Platform. Affected by this issue is some unknown functionality of the component PGP Signature Verification. Performing a manipulation results in signature verification. This vulnerability was named CVE-2026-75939. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Red Hat OpenShift Container Platform (affected version not known). This affects some unknown functionality of the component PGP Signature Verification. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-75939 since 08/18/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Red Hat

Name

• OpenShift Container Platform

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion