{"id":"CVE-2026-75569","aliases":["EUVD-2026-63086","GHSA-77qj-pc4h-hxwh"],"status":"published","title":"Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha","description":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00598,"percentile":0.48928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1357","CWE-829"],"published":"2026-08-19T20:47:45Z","modified":"2026-10-26T10:10:00Z","products":[{"vendor":"red hat","product":"multicluster engine for kubernetes 2.10"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.11"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.17"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:59634","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59636","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59637","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59638","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59642","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59643","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75569","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519849","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75569"},{"url":"https://github.com/advisories/GHSA-77qj-pc4h-hxwh"}],"sources":{"cve":[{"id":"CVE-2026-75569","title":"Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha","description":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.","status":"published","published":"2026-08-19T20:47:45.877Z","modified":"2026-09-29T19:41:48.297Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-1357"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-63086","description":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.","status":"published","published":"2026-08-19T20:47:45Z","modified":"2026-09-29T19:41:48Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:51.078545Z"}],"ghsa":[{"id":"GHSA-77qj-pc4h-hxwh","title":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a...","description":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.","status":"published","published":"2026-08-19T21:30:38Z","modified":"2026-09-02T18:32:57Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-829","CWE-1357"],"updated_at":"2026-11-02T15:11:17.943368Z"}],"nvd":[{"id":"CVE-2026-75569","description":"A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.","status":"published","published":"2026-08-19T21:17:37.287Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1357"],"updated_at":"2026-11-02T14:12:39.962615Z"}]}}