A flaw in the openshift/oc-mirror tool caused it to verify PGP signatures incorrectly by checking for signature errors before examining the entire signed payload, which allowed an attacker to craft a forged signature that appeared valid. This bypass let the tool accept malicious release images, potentially introducing compromised binaries into a disconnected registry and ultimately undermining the integrity of deployments.

Red Hat OpenShift Container Platform 4 is affected, specifically the oc-mirror component used to replicate release images. The vulnerability applies to all installed instances of oc-mirror that rely on PGP signature verification against Red Hat release keys. Users of OpenShift 4 should verify they are running the latest oc‑mirror version, or be aware that any copy of the tool remains susceptible until patched.

The CV score of 7.4 indicates a high severity vulnerability, while the EPSS score is not available and the issue is not yet listed in CISA's KEV catalog. Based on the description, it is inferred that a remote attacker with the ability to intercept or manipulate traffic to the signature endpoint could forge a signature and cause oc‑mirror to trust a malicious payload; no authentication boundary is mentioned, so the attack vector likely relies on network‑level intrusion.