When the legacy v1 catalog cache rebuild feature in oc‑mirror is invoked with the --build-catalog-cache flag, the tool downloads a catalog image, extracts an opm binary from that image, and executes it on the host host without performing any verification of its signature, digest, or integrity. An attacker who can host or publish a malicious operator catalog image to a registry that oc‑mirror pulls from can supply a trojanized opm binary, which will then run with the same privileges as the user executing oc‑mirror. This results in arbitrary code execution on the mirroring host and falls under CWE‑494, which concerns the execution of unsigned binaries.

The vulnerability affects the oc‑mirror command‑line utility whenever it performs the legacy v1 catalog cache rebuild using the --build-catalog-cache flag. No specific product versions are listed, therefore any installation that still relies on this legacy rebuild routine is potentially impacted.

The CVSS score of 7.5 indicates a high severity. EPSS information is not available, so the likelihood of exploitation is unknown, but the attack requires an adversary to control a registry that oc‑mirror pulls from. Once a malicious catalog image is provided, the attacker can execute code with the privileges of the oc‑mirror user. The vulnerability is not listed in CISA’s KEV catalog, and there is no evidence of known public exploitation. The most likely attack vector is the compromise of a registry or the use of a maliciously crafted catalog image.