Bug 2530057 (CVE-2026-87060)

Summary: CVE-2026-87060 olm-operator-konflux-sample: olm-operator-konflux-sample: Renovate automerge enabled with base-image update exclusions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: gbenhaim, niyer, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:06:10 UTC 
## Renovate automerge enabled with base-image update exclusions

**Component:** olm-operator-konflux-sample

Renovate automerge is enabled broadly rather than scoped to low-risk update types, while the catalog base image (`ose-operator-registry`) is excluded from tracking entirely, creating an inconsistent update posture.

### Remediation
Scope automerge to low-risk update types only (e.g. `packageRules` with `matchUpdateTypes: ["digest"]`) or set `automerge: false` and document required-review branch protection; remove the `ose-operator-registry` ignore so the catalog base is tracked.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-005*