CVE-2026-76139

HighCVSS 8.0/10Last modified Sep 8, 2026

Description

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-76144.3The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This CVE-2026-761429.3Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthe CVE-2026-761437.3A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login req CVE-2026-761441.8An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attac CVE-2026-761457.5An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force CVE-2026-761468.4An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to exe CVE-2026-761475.9A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Ge CVE-2026-761488.4CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.CVE-2026-761494.6CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.CVE-2026-76154.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due CVE-2026-761514.6Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through CVE-2026-761547.3A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrar