A flaw in kube-compare causes it to execute the entry point of an untrusted container image when it encounters a reference that uses the container:// scheme. Instead of simply extracting data from a stopped container, the tool runs the image, allowing a remote attacker to run arbitrary code on the operator's machine. If the Docker daemon requires elevated privileges, the attacker can obtain root‑level privileged access to the daemon, amplifying the compromise and creating a broad risk of system compromise.

The vulnerability affects Red Hat OpenShift Container Platform 4 and the Pen Drive Powered by Red Hat Lightspeed product. Specific affected product versions are not detailed in the CNA data. Operators should verify the exact installed components of OpenShift 4 and the Lightspeed driver.

The CVSS base score of 7.1 places this in the high‑risk category, yet its EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires only the use of kube‑compare with a container:// reference and does not need privileged network access, the attack vector is straightforward from a remote context that can supply the image reference. For Docker setups that require sudo, the attacker can gain elevated daemon permissions, turning the vulnerability into a full privilege escalation mechanism.