CVE-2026-87061

A flaw was found in olm-operator-konflux-sample. The bundle-hack/updatebundle.sh script lacks mechanisms to stop execution immediately upon encountering an error. This oversight allows critical data processing steps, such as those involving skopeo or jq commands, to fail silently and proceed with...

CVE-2026-87059

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process...

CVE-2026-87060

A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entire...

CVE-2026-87058

A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthines...

CVE-2026-87057

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introductio...