Skip to content
Fencer Intel
high 7.1

CVE-2026-96577 json

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

published last mo. modified 10h ago also EUVD-2026-90590

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.18 1790828598
  • Red Hat Red Hat OpenShift Container Platform 4.19 1790778095
  • Red Hat Red Hat OpenShift Container Platform 4.20 1790782357
  • Red Hat Red Hat OpenShift Container Platform 4.21 1790777129
  • Red Hat Red Hat OpenShift Container Platform 4.22 1790775357

Is CVE-2026-96577 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-96577 updated cvss 7.1

oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled

  • Red Hat OpenShift Container Platform 5 openshift5/oc-mirror-plugin-rhel9
    affected: workaround, no fix available “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.”
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9
    under investigation
  • Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9 1790828598
    fixed: vendor fix “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.” RHSA-2026:79039
  • Red Hat OpenShift Container Platform 4.19 openshift4/oc-mirror-plugin-rhel9 1790778095
    fixed: vendor fix “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.” RHSA-2026:74434
  • Red Hat OpenShift Container Platform 4.20 openshift4/oc-mirror-plugin-rhel9 1790782357
    fixed: vendor fix “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.” RHSA-2026:74380
  • Red Hat OpenShift Container Platform 4.21 openshift4/oc-mirror-plugin-rhel9 1790777129
    fixed: vendor fix “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.” RHSA-2026:74383
  • Red Hat OpenShift Container Platform 4.22 openshift4/oc-mirror-plugin-rhel9 1790775357
    fixed: vendor fix “Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.” RHSA-2026:74429
  • Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1790826545, openshift4/ose-cli-rhel9 1790882345, openshift4/ose-pod-rhel9 1790853956, openshift4/ose-etcd-rhel9 1791320060, openshift4/ose-tests-rhel9 1791373456, openshift4/ose-tools-rhel9 1791372072, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1790609925, openshift4/ose-cli-rhel9 1790627931, openshift4/ose-pod-rhel9 1790610735, openshift4/ose-etcd-rhel9 1790610190, openshift4/ose-tests-rhel9 1790738839, openshift4/ose-tools-rhel9 1790737528, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1790702743, openshift4/ose-cli-rhel9 1790701502, openshift4/ose-pod-rhel9 1790705159, openshift4/ose-etcd-rhel9 1790703604, openshift4/ose-tests-rhel9 1790707913, openshift4/ose-tools-rhel9 1790703780, +182 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1790703737, openshift4/ose-cli-rhel9 1790702464, openshift4/ose-pod-rhel9 1790704469, openshift4/ose-etcd-rhel9 1790706697, openshift4/ose-tests-rhel9 1790708632, openshift4/ose-tools-rhel9 1790704750, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1790741595, openshift4/ose-cli-rhel9 1790712167, openshift4/ose-pod-rhel9 1790723524, openshift4/ose-etcd-rhel9 1790712437, openshift4/ose-tests-rhel9 1790726162, openshift4/ose-tools-rhel9 1790712958, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last mo.

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.