CVE-2026-87053
Description
A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a malicious actor compromises the container, they could leverage these root privileges to perform unauthorized actions, potentially leading to a broader system compromise.
Statement
Moderate: The operator-sdk-builder component in Konflux generates container images that execute as the root user by default. This elevates the potential impact of a container compromise, as processes within the container will operate with full system privileges, even though exploitation requires the image to be built and run by a user.
Mitigation
To mitigate, modify the `Containerfile` used by `operator-sdk-builder` to explicitly set a non-root user after the `dnf install` layer. Insert `USER 1001` or `USER default` into the `Containerfile` before the `ENTRYPOINT` instruction. This ensures the resulting image runs with reduced privileges. If specific tasks genuinely require root, configure the consuming Tekton Task securityContext instead of baking root into the image. Rebuilding and redeploying affected images are necessary for these changes to take effect.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands; Read Application Data; DoS: Crash, Exit, or Restart
An attacker will be able to gain access to any resources that are allowed by the extra privileges. Common results include executing code, disabling services, and reading restricted data. New weaknesses can be exposed because running with extra privileges, such as root or Administrator, can disable the normal security checks being performed by the operating system or surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if they occur while operating at raised privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
