# CVE-2026-76139

## Summary

- **CVE ID:** CVE-2026-76139
- **Severity:** HIGH
- **CVSS Score:** 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-829
- **Published:** Aug 19, 2026
- **Last Modified:** Sep 8, 2026

## Description

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

## Affected Products

- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.14.0 (1787704476)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.13 (1787712120)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.14 (1787704476)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1787704231)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.11 (1787704547)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.15 (1787738299)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.16 (1787711895)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.16.0 (1787711895)

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-76139)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2519852)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60399)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60401)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60403)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60400)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60402)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60404)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.45%
- **EPSS Percentile:** 37.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-09._