CVE-2026-96577
highA flaw was found in oc-mirror.
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
CVSS
7.1
7.1 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2026-10-01 10:17
Modified: 2026-10-15 20:17
NVD status: Awaiting Analysis
Last synced 3 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/errata/RHSA-2026:74380 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:74383 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:74429 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:74434 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:79039 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-96577 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2523077 secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗