Cache image tampering via unauthenticated registry listener

Missing authentication in Red Hat oc-mirror’s embedded cache registry allows remote attackers on adjacent networks to read or alter cached images. The registry configuration binds its HTTP listener to all interfaces, leaves authentication commented out, and enables deletion. Exposure lasts while a mirroring run is active; an attacker with network access to the listener can push tampered images, delete cached images, or pull mirrored content.