mce-operator-bundle Build Process Code Injection via Unverified Remote Scripts
CVE-2026-75569 Published on August 19, 2026

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-75569 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 23 days later.

Weakness Type

CWE-1357

Products Associated with CVE-2026-75569

Want to know whenever a new CVE is published for Red Hat Multicluster Engine? stack.watch will email you.

Red Hat Multicluster Engine
 

Affected Versions

Red Hat multicluster engine for Kubernetes 2.1: Red Hat multicluster engine for Kubernetes 2.11: Red Hat multicluster engine for Kubernetes 2.17: Red Hat multicluster engine for Kubernetes 2.6: Red Hat multicluster engine for Kubernetes 2.8: Red Hat multicluster engine for Kubernetes 2.9: