What is the CVSS score of CVE-2026-76139?

CVE-2026-76139 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ACM Operator Bundle are affected by CVE-2026-76139?

Red Hat Advanced Cluster Management for Kubernetes 2 build pipelines lack cryptographic verification when fetching remote build scripts, directly exposing privileged GitHub tokens and container…

How to fix or mitigate CVE-2026-76139?

Within 24 hours, inventory all Red Hat Advanced Cluster Management for Kubernetes 2 installations, identify which are actively building, and audit build pipeline logs for unauthorized script access or credential usage anomalies. Within 7 days, implement network segmentation isolating build environments with outbound access restricted to pre-approved hosts only, enable forensic logging of all build operations and credential access, rotate all GitHub tokens and container registry credentials used in ACM build pipelines, and establish a mandatory cryptographic verification step for remote scripts. Within 30 days, deploy code signing verification requirements for all generated operator bundles before deployment to any cluster, document the current state of deployed ACM operator bundles for forensic review, and establish monitoring for Red Hat security advisories regarding CVE-2026-76139 patches.

ACM Operator Bundle CVE-2026-76139

EUVD-2026-63087 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-08-19 redhat

GHSA-37hx-9chj-hc3m

Authentication Bypass Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

8.0

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

AV:N for remote script fetch; AC:H for server compromise or MITM prerequisite; PR:H for attacker needing control of remote script source; S:C as poisoned bundle propagates to downstream Kubernetes clusters.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 21:37 vuln.today

CVE Published

Aug 19, 2026 - 20:47 nvd

HIGH 8.0

DescriptionCVE.org

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

AnalysisAI

The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.

Technical ContextAI

CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) is the root cause: the build tooling unconditionally fetches a shell or build script from a remote URL and executes it without comparing it against a known-good hash or validating a cryptographic signature. This is a classic 'curl | bash' anti-pattern embedded in a CI/CD pipeline. The affected product, confirmed by CPE cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*, is the full Red Hat ACM for Kubernetes 2.x line. Because the build environment holds privileged credentials scoped to source repositories and container registries, any code injected at the script-fetch stage operates with those secrets in scope - there is no isolation boundary between the untrusted remote script and the credential store.

RemediationAI

The primary fix is to apply the patched acm-operator-bundle version from Red Hat for ACM 2.x; consult the advisory at https://access.redhat.com/security/cve/CVE-2026-76139 for the exact fixed release, as a specific patch version is not confirmed in the available input data. If the build pipeline has already executed against affected versions, immediately rotate all GitHub access tokens and container registry passwords that were present as environment variables or mounted secrets in the build environment - this is time-sensitive and should not wait on patching. As a compensating control before patching, restrict CI/CD pipeline network egress to an allowlist that blocks arbitrary external script fetches; be aware this may break other build dependencies and requires validation in a staging pipeline first. Longer-term, replace any remote script fetches with pinned, locally vendored copies verified against a SHA-256 or SHA-512 digest stored in version control. Do not rely on HTTPS alone as an integrity guarantee, as it does not protect against server-side compromise.