{}

{}

{}

{"bugzilla": {"description": "operator-sdk-builder: operator-sdk-builder: Final container image runs as root (USER root never reverted)", "id": "2530044", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530044"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-250", "details": ["A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a malicious actor compromises the container, they could leverage these root privileges to perform unauthorized actions, potentially leading to a broader system compromise."], "mitigation": {"lang": "en:us", "value": "To mitigate, modify the `Containerfile` used by `operator-sdk-builder` to explicitly set a non-root user after the `dnf install` layer. Insert `USER 1001` or `USER default` into the `Containerfile` before the `ENTRYPOINT` instruction. This ensures the resulting image runs with reduced privileges. If specific tasks genuinely require root, configure the consuming Tekton Task securityContext instead of baking root into the image. Rebuilding and redeploying affected images are necessary for these changes to take effect."}, "name": "CVE-2026-87053", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87053\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87053"], "statement": "Moderate: The `operator-sdk-builder` component in Konflux generates container images that execute as the root user by default. This elevates the potential impact of a container compromise, as processes within the container will operate with full system privileges, even though exploitation requires the image to be built and run by a user.", "threat_severity": "Moderate"}