RCE: oc-mirror Local Cache Registry Exposes All Interfaces
CVE-2026-96577 Published on October 1, 2026
Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 30 days later.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-96577
stack.watch emails you whenever new vulnerabilities are published in Red Hat Assisted Installer or Red Hat Openshift. Just hit a watch button to start following.
