CVE-2026-75569
HighCVSS 7.7Summary
The build process of mce-operator-bundle fetches and executes scripts from a remote repository without integrity checks, such as commit pinning or signature verification. A malicious actor with write access to the repository can inject and execute arbitrary code during the build. This compromises the build process and may lead to distribution of malicious software.
Risk Assessment
The risk is that malicious code can be injected into build artifacts, potentially leading to distribution of compromised software to end users and loss of trust in the delivered product.
Recommendation
Immediately verify the integrity of all scripts fetched from remote repositories by using commit pinning and signature verification. Also audit the build process for unauthorized changes.
Original NVD description (English source)
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.