Skip to content
Fencer Vulns
high 7.1

CVE-2026-87114 json

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

published 2026-09-28 41 d ago modified 2026-10-07 32 d ago also EUVD-2026-88361

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits
0
none known

Summary

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.19 1790632105
  • Red Hat Red Hat OpenShift Container Platform 4.20 1790707563
  • Red Hat Red Hat OpenShift Container Platform 4.21 1790707362
  • Red Hat Red Hat OpenShift Container Platform 4.22 1790718431

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-87114 updated cvss 7.1

kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

  • Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.19 openshift4/kube-compare-artifacts-rhel9 1790632105
    fixed: vendor fix RHSA-2026:74435
  • Red Hat OpenShift Container Platform 4.20 openshift4/kube-compare-artifacts-rhel9 1790707563
    fixed: vendor fix RHSA-2026:74381
  • Red Hat OpenShift Container Platform 4.21 openshift4/kube-compare-artifacts-rhel9 1790707362
    fixed: vendor fix RHSA-2026:74384
  • Red Hat OpenShift Container Platform 4.22 openshift4/kube-compare-artifacts-rhel9 1790718431
    fixed: vendor fix RHSA-2026:74430
  • Red Hat OpenShift Container Platform 4.19 openshift4/metallb-rhel9 1790610229, openshift4/ose-ptp-rhel9 1790610544, openshift4/sriov-cni-rhel9 1790610335, openshift4/pf-status-relay-rhel9 1790610307, openshift4/ptp-must-gather-rhel9 1790631271, openshift4/metallb-rhel9-operator 1790609674, +40 more Red Hat OpenShift Container Platform 4.20 openshift4/metallb-rhel9 1790702140, openshift4/ose-ptp-rhel9 1790701749, openshift4/sriov-cni-rhel9 1790702415, openshift4/pf-status-relay-rhel9 1790702053, openshift4/ptp-must-gather-rhel9 1790703868, openshift4/metallb-rhel9-operator 1790701993, +38 more Red Hat OpenShift Container Platform 4.21 openshift4/metallb-rhel9 1790703844, openshift4/ose-ptp-rhel9 1790702715, openshift4/sriov-cni-rhel9 1790702021, openshift4/pf-status-relay-rhel9 1790702308, openshift4/ptp-must-gather-rhel9 1790705118, openshift4/metallb-rhel9-operator 1790702776, +38 more Red Hat OpenShift Container Platform 4.22 openshift4/metallb-rhel9 1790712823, openshift4/ose-ptp-rhel9 1790710027, openshift4/sriov-cni-rhel9 1790712247, openshift4/pf-status-relay-rhel9 1790712051, openshift4/ptp-must-gather-rhel9 1790717986, openshift4/metallb-rhel9-operator 1790741564, +38 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
40 d ago

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Pen Drive Powered by Red Hat Lightspeed

Classification

Weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.