{}

{}

{}

{"bugzilla": {"description": "operator-sdk-builder: operator-sdk-builder: containers-policy.json defaults to insecureAcceptAnything for non-Red Hat registries", "id": "2530045", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530045"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-345", "details": ["A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted registries, which could allow for the use of untrusted or malicious container images."], "mitigation": {"lang": "en:us", "value": "To prevent the use of untrusted container images, configure the `containers-policy.json` to reject unsigned images by default. Set the `default` policy to `{\"type\": \"reject\"}` and add explicit `signedBy` or `sigstoreSigned` entries for all trusted registries. This policy should be mounted when invoking `opm` or `operator-sdk` against third-party registries. A restart of the `operator-sdk-builder` or related services may be required for the new policy to be enforced."}, "name": "CVE-2026-87054", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87054\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87054"], "statement": "This Moderate flaw in `operator-sdk-builder` within Konflux allows skipping image signature verification for non-Red Hat registries due to an insecure default policy. This could enable the use of untrusted container images if not explicitly configured, increasing the risk of supply chain attacks.", "threat_severity": "Moderate"}