A local cache registry in oc‑mirror is bound to all network interfaces, exposing it to unauthenticated remote access. The registry accepts push, pull, and delete operations without authentication or encryption, permitting an attacker on an adjacent network to upload tampered container images, delete cached images, or read mirrored content. This authentication failure (CWE‑306) jeopardizes the integrity and availability of container images, potentially disrupting deployments and allowing the introduction of malicious artifacts. The vulnerability enables a trivial, network‑based attack that can roll out compromised images across an OpenShift cluster or purge critical assets from the cache.

The vulnerability occurs in the oc‑mirror component within Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 and Red Hat OpenShift Container Platform 4. It affects oc‑mirror release 4.21, which is used in these products. No other affected versions are indicated.

The CVSS score of 7.1 denotes medium severity. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network-based one: an attacker with network access to the host hosting the registry can connect on the exposed port, authenticate as none, and send HTTP DELETE requests. No specific exploit code is cited, but the lack of authentication makes the vulnerability trivial to exploit if the registry is reachable from untrusted networks.