CVE-2026-76139

Published: Ago 19, 2026 Last Modified: Ago 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

829

Inclusion of Functionality from Untrusted Control Sphere

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-76139
https://access.redhat.com/security/cve/CVE-2026-76139
https://bugzilla.redhat.com/show_bug.cgi?id=2519852
https://bugzilla.redhat.com/show_bug.cgi?id=2519852