CVE-2026-87058
Description
A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthiness of the resulting software artifacts. This introduces a supply chain risk where the final product might contain unintended or malicious code.
Statement
This issue has a Low impact on Red Hat Konflux CI. The default configuration of shared pipelines in olm-operator-konflux-sample disables hermetic builds, allowing live network fetches during bundle creation. This introduces a potential supply chain risk by relying on external, unverified inputs during the build process, rather than affecting the runtime security of deployed applications.
Mitigation
To reduce the risk of external interference during bundle builds, enable hermetic build mode within Konflux shared pipelines. This can be achieved by setting the `hermetic` default to `"true"` in the relevant pipeline configurations. Additionally, ensure `prefetch-input` is supplied for gatekeeper/gatekeeper-operator Go builds and replace dynamic `skopeo inspect` architecture detection with statically-declared architecture labels. Changes to pipeline configurations may require re-running affected builds.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, open redirect to malware (CWE-601), etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
