Bug 2530047 (CVE-2026-87056)

Summary:	CVE-2026-87056 operator-sdk-builder: operator-sdk-builder: No automated dependency-update configuration for submodules or Containerfile
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gbenhaim, niyer, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:05:15 UTC

## No automated dependency-update configuration for submodules or Containerfile

**Component:** operator-sdk-builder

The repository has no Renovate/Dependabot configuration covering git submodules, the Containerfile base image, or Tekton bundle references, so stale/vulnerable pins are not automatically flagged.

### Remediation
Add a renovate.json (or enable Konflux MintMaker rules) covering `git-submodules`, `dockerfile` and `tekton` managers so submodule SHAs and base-image digests receive automated update PRs.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-004*