All vulnerabilities
CVE-2026-96577

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

Red Hat Red Hat OpenShift Container Platform 4.18Operating systems
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published1 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.

Text from CVE List

Affected versions 5

  • Red Hat OpenShift Container Platform 4.18unaffected: 1790828598 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 1790778095 and laterCVE List
  • Red Hat OpenShift Container Platform 4.20unaffected: 1790782357 and laterCVE List
  • Red Hat OpenShift Container Platform 4.21unaffected: 1790777129 and laterCVE List
  • Red Hat OpenShift Container Platform 4.22unaffected: 1790775357 and laterCVE List

References 7