CVE-2026-87060
Description
A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system.
Statement
This issue has a Low impact as it pertains to the configuration of Renovate automerge within the olm-operator-konflux-sample component of Konflux. The broad enablement of automerge, coupled with the exclusion of the ose-operator-registry base image from tracking, creates an inconsistent update posture that could lead to outdated dependencies rather than direct exploitation.
Mitigation
To mitigate this issue, configure Renovate to scope automerge to low-risk update types only, such as `packageRules` with `matchUpdateTypes: ["digest"]`. Alternatively, set `automerge: false` and implement required-review branch protection. Additionally, remove the exclusion for `ose-operator-registry` to ensure the catalog base image is tracked for updates. These changes should be applied to the Renovate configuration within the `olm-operator-konflux-sample` component. A restart or reload of the Renovate process may be required for the changes to take effect.
Understanding the Weakness (CWE)
Other
Technical Impact: Reduce Maintainability
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
