Bug 2530045 (CVE-2026-87054)
| Summary: | CVE-2026-87054 operator-sdk-builder: operator-sdk-builder: containers-policy.json defaults to insecureAcceptAnything for non-Red Hat registries | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | gbenhaim, niyer, twaugh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted registries, which could allow for the use of untrusted or malicious container images.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
## containers-policy.json defaults to insecureAcceptAnything for non-Red Hat registries **Component:** operator-sdk-builder The image's containers-policy.json sets the default policy to insecureAcceptAnything, so signature verification is skipped entirely for any registry not explicitly listed. ### Remediation Change the `default` policy to `{"type": "reject"}` and add explicit `signedBy`/`sigstoreSigned` entries for every registry the builder is expected to pull from (e.g. quay.io/konflux-ci, quay.io/openshift-release-dev). At minimum, document that consumers must mount a stricter policy.json when invoking opm/operator-sdk against third-party registries. --- *Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-002*