CWE-1357
Allowed-with-ReviewReliance on Insufficiently Trustworthy Component
Abstraction: Class · Status: Incomplete
The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
14 vulnerabilities reference this CWE, most recent first.
GHSA-77QJ-PC4H-HXWH
Vulnerability from github – Published: 2026-08-19 21:30 – Updated: 2026-09-02 18:31A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
{
"affected": [],
"aliases": [
"CVE-2026-75569"
],
"database_specific": {
"cwe_ids": [
"CWE-1357",
"CWE-829"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T21:17:37Z",
"severity": "HIGH"
},
"details": "A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.",
"id": "GHSA-77qj-pc4h-hxwh",
"modified": "2026-09-02T18:31:55Z",
"published": "2026-08-19T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75569"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59634"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59636"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59637"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59638"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59642"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59643"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-75569"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519849"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-77XH-V3Q4-C2C6
Vulnerability from github – Published: 2026-08-04 18:31 – Updated: 2026-08-04 18:31NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-47619"
],
"database_specific": {
"cwe_ids": [
"CWE-1357"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T18:16:51Z",
"severity": "MODERATE"
},
"details": "NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.",
"id": "GHSA-77xh-v3q4-c2c6",
"modified": "2026-08-04T18:31:30Z",
"published": "2026-08-04T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47619"
},
{
"type": "WEB",
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5842"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47619"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-95W2-696M-24MQ
Vulnerability from github – Published: 2026-08-18 18:32 – Updated: 2026-09-03 15:32A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
{
"affected": [],
"aliases": [
"CVE-2026-66783"
],
"database_specific": {
"cwe_ids": [
"CWE-1357",
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T17:17:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.",
"id": "GHSA-95w2-696m-24mq",
"modified": "2026-09-03T15:32:01Z",
"published": "2026-08-18T18:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66783"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63016"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-66783"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507528"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WRJ7-2JF7-86P9
Vulnerability from github – Published: 2026-08-26 21:31 – Updated: 2026-08-26 21:31Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.
{
"affected": [],
"aliases": [
"CVE-2026-67275"
],
"database_specific": {
"cwe_ids": [
"CWE-1357"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T20:17:57Z",
"severity": "MODERATE"
},
"details": "Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.",
"id": "GHSA-wrj7-2jf7-86p9",
"modified": "2026-08-26T21:31:44Z",
"published": "2026-08-26T21:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67275"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000500902/dsa-2026-369-security-update-for-dell-powerprotect-one-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each component, ensure that its supply chain is well-controlled with sub-tier suppliers using best practices. For third-party software components such as libraries, ensure that they are developed and actively maintained by reputable vendors.
Mitigation
Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Mitigation
Continue to monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, supplier practices that affect trustworthiness, etc.
No CAPEC attack patterns related to this CWE.