Bug 2530054 (CVE-2026-87057)

Summary:	CVE-2026-87057 olm-operator-konflux-sample: olm-operator-konflux-sample: Runtime base images referenced by mutable floating tags
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gbenhaim, niyer, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introduction of malicious code or unexpected changes in the build process. An attacker could exploit this to compromise the integrity of the software supply chain.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:06:02 UTC

## Runtime base images referenced by mutable floating tags

**Component:** olm-operator-konflux-sample

Runtime base images in the build pipelines are referenced by mutable floating tags rather than immutable sha256 digests, and `ose-operator-registry` is excluded from Renovate's digest tracking.

### Remediation
Pin every `FROM` to `<tag>@sha256:<digest>` and remove `ose-operator-registry` from `renovate.json` `ignoreDeps` (or add a dedicated `pinDigests: true` rule) so Mintmaker keeps the digests fresh while preserving immutability.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-001*