CVE-2026-87114

Description

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

Traduire en français

Produits concernés

• Red Hat OpenShift Container Platform 4.19
• Red Hat OpenShift Container Platform 4.20
• Red Hat OpenShift Container Platform 4.21
• Red Hat OpenShift Container Platform 4.22
• Red Hat Pen Drive Powered by Red Hat Lightspeed

Scores CVSS

Faiblesses (CWE)

• CWE-829

Références

• https://access.redhat.com/errata/RHSA-2026:74381
• https://access.redhat.com/errata/RHSA-2026:74384
• https://access.redhat.com/errata/RHSA-2026:74430
• https://access.redhat.com/errata/RHSA-2026:74435
• https://access.redhat.com/security/cve/CVE-2026-87114
• https://bugzilla.redhat.com/show_bug.cgi?id=2522945

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories