Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-87114

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1790632105 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1790707563 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1790707362 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.22

Default version status: affected

  • 1790718431 to < *unaffected

Red Hat Pen Drive Powered by Red Hat Lightspeed

Default version status: affected

References