EUVD-2026-63087

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-76139

The acm-operator-bundle build process executes an unpinned script from stolostrum/release@master using full build credentials (GitHub tokens, registry passwords) without verifying authenticity or integrity. A remote attacker controlling that script could inject malicious code, gaining unauthorize...

CVE-2026-76139

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...