{}

{}

{}

{"bugzilla": {"description": "olm-operator-konflux-sample: olm-operator-konflux-sample: Hermetic build disabled by default; bundle build performs live network fetches", "id": "2530055", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530055"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthiness of the resulting software artifacts. This introduces a supply chain risk where the final product might contain unintended or malicious code."], "mitigation": {"lang": "en:us", "value": "To reduce the risk of external interference during bundle builds, enable hermetic build mode within Konflux shared pipelines. This can be achieved by setting the `hermetic` default to `\"true\"` in the relevant pipeline configurations. Additionally, ensure `prefetch-input` is supplied for gatekeeper/gatekeeper-operator Go builds and replace dynamic `skopeo inspect` architecture detection with statically-declared architecture labels. Changes to pipeline configurations may require re-running affected builds."}, "name": "CVE-2026-87058", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87058\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87058"], "statement": "This issue has a Low impact on Red Hat Konflux CI. The default configuration of shared pipelines in `olm-operator-konflux-sample` disables hermetic builds, allowing live network fetches during bundle creation. This introduces a potential supply chain risk by relying on external, unverified inputs during the build process, rather than affecting the runtime security of deployed applications.", "threat_severity": "Low"}

{}