Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-75569

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat multicluster engine for Kubernetes 2.10

Default version status: affected

  • 1787263075 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.11

Default version status: affected

  • 1787321579 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.17

Default version status: affected

  • 1787083639 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.6

Default version status: affected

  • 1787317415 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.8

Default version status: affected

  • 1787318262 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.9

Default version status: affected

  • 1787287150 to < *unaffected

References