Skip to content
Fencer Vulns
high 8.0

CVE-2026-76139 json

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

published 2026-08-19 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-63087

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

Patch / fix

  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 1787704547
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1787712120
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1787704476
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1787738299
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1787711895
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 1787704231

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76139 updated cvss 8.0

acm-operator-bundle: acm-operator-bundle: Bundle build execs unpinned stolostron/release@master with full build credentials

  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/acm-operator-bundle 1787704547
    fixed: vendor fix RHSA-2026:60404
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/acm-operator-bundle 1787712120
    fixed: vendor fix RHSA-2026:60403
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/acm-operator-bundle 1787704476
    fixed: vendor fix RHSA-2026:60401
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/acm-operator-bundle 1787738299
    fixed: vendor fix RHSA-2026:60402
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/acm-operator-bundle 1787711895
    fixed: vendor fix RHSA-2026:60400
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/acm-operator-bundle 1787704231
    fixed: vendor fix RHSA-2026:60399

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Classification

Weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.