CVE-2026-101295: Red Hat Assisted Installer For Red Hat Openshift Container Platform 2

High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days.

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

Affected products

• Red Hat Assisted Installer For Red Hat Openshift Container Platform 2
• Red Hat Red Hat Openshift Container Platform 4

Published 2026-09-30. Last modified 2026-09-30.