# CVE-2026-96577: oc-mirror unauthenticated registry access on all interfaces

Source: https://junglewise.ai/threats/cve-2026-96577-a-flaw-was-found-in-oc-mirror-during-mirroring-operations-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-96577 · Severity: high · CVSS 7.1 · Published 2026-10-01

oc-mirror is a container image synchronization tool used in OpenShift Container Platform. During mirroring operations, its embedded registry exposes itself to all network interfaces without authentication, allowing attackers on adjacent networks to inject malicious container images, delete cached data, or access mirrored content without credentials. This compromises the integrity of container supply chains during image synchronization tasks.

Technologies: [Red Hat Oc-Mirror](https://junglewise.ai/threats/technologies/oc-mirror). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-96577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96577 being exploited in the wild.

**How severe is CVE-2026-96577?** High severity, with a CVSS score of 7.1, published 1 October 2026.

**Which products and versions are affected?** Red Hat oc-mirror.

**Is there a fix for CVE-2026-96577?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96577 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2026-96577?** Check whether you run Red Hat Oc-Mirror. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The embedded local cache registry in oc-mirror binds to all network interfaces (0.0.0.0) instead of restricting to localhost, missing authentication for critical registry functions (CWE-306). An unauthenticated attacker on an adjacent network can push tampered container images, delete cached images, or read mirrored content. Exploitation requires network adjacency and occurs during active mirroring workflows; Red Hat has not identified mitigations and advises waiting for security updates.

## Affected products

- Red Hat oc-mirror

## Timeline

- 2026-10-01: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-96577](https://access.redhat.com/security/cve/CVE-2026-96577)

## Related threats

- [OpenShift oc-mirror path traversal in operator catalog extraction](https://junglewise.ai/threats/cve-2026-101295-path-traversal-arbitrary-file-write-in-oc-mirror-s-operator)
- [Red Hat oc-mirror PGP signature verification bypass](https://junglewise.ai/threats/cve-2026-75939-a-flaw-was-found-in-openshift-oc-mirror-the-tool-incorrectly)