Description

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-21T15:17:31.520Z",
  "pubdate": "2026-09-21T15:17:31.520Z",
  "executiveSummary": "A critical security vulnerability exists in the openshift/oc-mirror tool, involving an improper implementation of PGP signature verification for release images.\nThe flaw allows an attacker to bypass signature validation by exploiting the premature checking of signature errors before the entire signed message body is fully processed.\nAn unauthenticated, remote attacker capable of intercepting or manipulating network traffic can inject a malicious payload while presenting a valid Red Hat release key ID, deceiving the tool into confirming the authenticity of forged content.\nThis vulnerability compromises the software supply chain integrity, as it facilitates the mirroring of unauthorized, malicious images into disconnected registries.\nSuccessful exploitation results in the deployment of untrusted software, potentially leading to unauthorized system access, data exfiltration, or complete host compromise within an OpenShift environment.\nThis issue represents a significant risk to organizations relying on oc-mirror for secure artifact distribution in air-gapped or disconnected network segments.",
  "technicalDetails": "The root cause of this vulnerability lies in the sequential logic of the PGP signature verification routine within the oc-mirror tool. Specifically, the implementation performs an incomplete evaluation of the signature status by checking for errors before the completion of the streaming body processing.\nThis race-like condition or logical flaw allows the verification function to return a false-positive state. Because the validation logic terminates or validates based on the initial signature metadata header before the cryptographic verification of the entire payload is finalized, an attacker can craft a PGP message that references a legitimate Red Hat key ID but contains a payload signed with a forged or invalid signature.\nThe exploitation flow involves a Man-in-the-Middle (MitM) or network injection attack. An attacker monitors the traffic destined for the release signature endpoint. When the oc-mirror tool initiates a download, the attacker intercepts the communication and injects a crafted PGP message. The tool, in its flawed verification process, identifies the correct key ID from the header and, due to the incorrect check sequence, proceeds to accept the payload as verified before the actual cryptographic signature verification of the entire blob is enforced.\nThis enables the mirroring of a malicious image payload into the target disconnected registry. By successfully bypassing the cryptographic check, the tool assumes the artifact is legitimate and propagates the malicious binary to downstream environments.\nThe impact is a complete breakdown of trust in the mirrored content. Since oc-mirror is intended to be a secure conduit for importing images into secure, isolated environments, the bypass invalidates the security boundary provided by the signature verification mechanism.\nThe vulnerability does not require authentication or elevated privileges beyond the ability to influence network traffic, making it a highly attractive target for supply chain attacks. Post-exploitation allows the attacker to deliver arbitrary malicious images, which will then be consumed by automated cluster deployment pipelines, leading to unauthorized code execution within the secure infrastructure."
}