Known issues#
This section describes the MSR known issues with available workarounds, along with a list of current product limitations:
(ENGDTR-5013) Cosign signature details not listed in v1 API response#
The signatures array returned by the MSR v1 repositories/tags API
does not include entries for Cosign signatures. Only DCT/Notary
signatures are listed there. The cosignSigned field still
correctly reports whether an image has one or more Cosign signatures,
but individual signature details are not enumerated for Cosign.
Workaround
Cosign signing and verification are client-side operations by design.
Use the cosign CLI (for example, cosign tree or cosign
verify) as the source of truth for inspecting and validating Cosign
signatures on an image.
Critical CVEs in MSR 2.10.0 component images#
Security scans of MSR 2.10.0 might report the following critical vulnerabilities in product component images.
| Component | Vulnerability | CVE | Installed version | Fixed version |
|---|---|---|---|---|
dtr-postgres |
libcrypto3 (OS package) |
CVE-2026-34182 | 3.5.6-r0 | 3.5.7-r0 |
dtr-postgres |
libssl3 (OS package) |
CVE-2026-34182 | 3.5.6-r0 | 3.5.7-r0 |
dtr-* |
github.com/containerd/containerd (Go module) |
CVE-2026-53488 | v1.7.12 | v1.7.33 |
These findings present low practical risk for typical MSR deployments:
- The
libcrypto3andlibssl3packages are present in thedtr-postgresimage. This image is not exposed to external networks. - MSR uses the
containerddependency as a library for image manifest handling. MSR does not run acontainerddaemon, so the CRI code path affected by CVE-2026-53488 does not run.
Resolution
Mirantis plans to address these CVEs in a future release.