{}

{}

{}

{"bugzilla": {"description": "olm-operator-konflux-sample: olm-operator-konflux-sample: Unpinned pip dependency installation in bundle builder stage", "id": "2530056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530056"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-494", "details": ["A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that the bundle builder stage for `olm-operator-konflux-sample` uses pinned versions and hash verification for pip dependencies. This can be achieved by dropping the `--upgrade pip` command, vendoring a hash-pinned `requirements.txt` file, and installing dependencies using `pip3 install --no-deps --require-hashes -r requirements.txt`. Alternatively, prefetch pip inputs via Cachi2 to ensure a hermetic build process. Implementing these changes will require adjustments to the build pipeline configuration."}, "name": "CVE-2026-87059", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87059\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87059"], "statement": "This vulnerability has a Low impact on Konflux environments. The `olm-operator-konflux-sample` bundle builder stage is susceptible to pulling in malicious pip packages due to unpinned dependencies and lack of hash verification. Exploitation requires an attacker to compromise a package release or the build process itself, making it difficult to achieve.", "threat_severity": "Low"}