Bug 2530046 (CVE-2026-87055) - CVE-2026-87055 operator-sdk-builder: operator-sdk-builder: Base image referenced by mutable tag rather than sha256 digest
Summary: CVE-2026-87055 operator-sdk-builder: operator-sdk-builder: Base image referen...
Keywords:
Status: NEW
Alias: CVE-2026-87055
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-08 19:05 UTC by OSIDB Bzimport
Modified: 2026-09-08 19:44 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-08 19:05:10 UTC 
## Base image referenced by mutable tag rather than sha256 digest

**Component:** operator-sdk-builder

The Containerfile's FROM line references the go-toolset base image by mutable tag rather than an immutable sha256 digest, allowing the resolved base image to change between builds.

### Remediation
Append the resolved digest, e.g. `FROM registry.access.redhat.com/ubi9/go-toolset:1.25.5-1770654497@sha256:<digest>`, and let MintMaker/Renovate manage digest bumps.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-003*
Note You need to log in before you can comment on or make changes to this bug.