7.7

CVE-2026-75569

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.10
Default Statusaffected
Version 1787263075
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.11
Default Statusaffected
Version 1787321579
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.17
Default Statusaffected
Version 1787083639
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.6
Default Statusaffected
Version 1787317415
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.8
Default Statusaffected
Version 1787318262
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.9
Default Statusaffected
Version 1787287150
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.213
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.7 1.3 5.8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
CWE-1357 Reliance on Insufficiently Trustworthy Component

The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

https://access.redhat.com/security/cve/CVE-2026-75569
https://bugzilla.redhat.com/show_bug.cgi?id=2519849
https://access.redhat.com/errata/RHSA-2026:59634
https://access.redhat.com/errata/RHSA-2026:59636
https://access.redhat.com/errata/RHSA-2026:59638
https://access.redhat.com/errata/RHSA-2026:59642
https://access.redhat.com/errata/RHSA-2026:59643
https://access.redhat.com/errata/RHSA-2026:59637