CVE-2026-7309

MEDIUM4.3

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

Published Apr 28, 2026

Modified 1 weeks ago

Details

A flaw was found in the OpenShift Container Platform build system. A user with the edit ClusterRole can inject arbitrary environment variables, such as LD_PRELOAD or http_proxy, into docker-build containers through the buildconfigs/instantiate API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

References

WEB

https://access.redhat.com/security/cve/CVE-2026-7309

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2463451

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-7309

CVSS Analysis

CVSS v3.1

4.3

Exploitability

Attack Vector