Bug 2530046 (CVE-2026-87055)

Summary: CVE-2026-87055 operator-sdk-builder: operator-sdk-builder: Base image referenced by mutable tag rather than sha256 digest
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: gbenhaim, niyer, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce vulnerabilities or malicious code into the build process, posing a supply chain integrity risk.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:05:10 UTC 
## Base image referenced by mutable tag rather than sha256 digest

**Component:** operator-sdk-builder

The Containerfile's FROM line references the go-toolset base image by mutable tag rather than an immutable sha256 digest, allowing the resolved base image to change between builds.

### Remediation
Append the resolved digest, e.g. `FROM registry.access.redhat.com/ubi9/go-toolset:1.25.5-1770654497@sha256:<digest>`, and let MintMaker/Renovate manage digest bumps.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-003*