CVE-2026-87114: Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-10-07
Weakness: CWE-829

Description

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

Affected products

Red Hat Pen Drive Powered by Red Hat Lightspeed: all versions
Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1790632105
Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1790707563
Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1790707362
Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1790718431

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.19 1790632105; Red Hat OpenShift Container Platform 4.20 1790707563; Red Hat OpenShift Container Platform 4.21 1790707362; Red Hat OpenShift Container Platform 4.22 1790718431. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-87114 or the next vulnerability affects your stack