CVE-2026-87059
Description
A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds.
Statement
This vulnerability has a Low impact on Konflux environments. The olm-operator-konflux-sample bundle builder stage is susceptible to pulling in malicious pip packages due to unpinned dependencies and lack of hash verification. Exploitation requires an attacker to compromise a package release or the build process itself, making it difficult to achieve.
Mitigation
To mitigate this issue, ensure that the bundle builder stage for `olm-operator-konflux-sample` uses pinned versions and hash verification for pip dependencies. This can be achieved by dropping the `--upgrade pip` command, vendoring a hash-pinned `requirements.txt` file, and installing dependencies using `pip3 install --no-deps --require-hashes -r requirements.txt`. Alternatively, prefetch pip inputs via Cachi2 to ensure a hermetic build process. Implementing these changes will require adjustments to the build pipeline configuration.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Other
Executing untrusted code could compromise the control flow of the program. The untrusted code could execute attacker-controlled commands, read or modify sensitive resources, or prevent the software from functioning correctly for legitimate users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
