CVE-2026-76139: Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.
Other sources
The acm-operator-bundle build fetches whatever is at stolostron/release@master HEAD at run time and execs tools/konflux/common/process-triggering-pr.sh from it. There is no commit-SHA pin, no checksum, and no signature verification. The exec'd script inherits the full environment of the triggering step, including a GitHub App token scoped to all repos under github.repositoryowner, registry passwords for registry.redhat.io/registry.stage.redhat.io/quay.io, and write access to the bundle PR that becomes the shipped ACM operator bundle. (Related weakness: CWE-494, Download of Code Without Integrity Check.)
Upstream Jira: ACM-38668
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
The supplied severity vector indicates network reachability, high attack complexity, and high privileges required. Successful exploitation involves causing the build process to run malicious code through the remotely downloaded script.
What assets are at risk if exploitation succeeds?
The downloaded script can access GitHub access tokens and registry passwords present in the build environment. An attacker could use this access to compromise build resources and potentially tamper with the resulting operator bundle.