A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

The acm-operator-bundle build fetches whatever is at stolostron/release@master HEAD at run time and execs tools/konflux/common/process-triggering-pr.sh from it. There is no commit-SHA pin, no checksum, and no signature verification. The exec'd script inherits the full environment of the triggering step, including a GitHub App token scoped to all repos under github.repositoryowner, registry passwords for registry.redhat.io/registry.stage.redhat.io/quay.io, and write access to the bundle PR that becomes the shipped ACM operator bundle. (Related weakness: CWE-494, Download of Code Without Integrity Check.)

Upstream Jira: ACM-38668