CVE-2026-7309

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-7309	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2463451	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en el sistema de compilación de OpenShift Container Platform. Un usuario con el ClusterRole ’edit’ puede inyectar variables de entorno arbitrarias, como ’LD_PRELOAD’ o ’http_proxy’, en contenedores ’docker-build’ a través de la API ’buildconfigs/instantiate’. Esta corrección incompleta para una vulnerabilidad anterior permite la revelación de información, impactando específicamente la confidencialidad del tráfico de compilación.

Information

Published : 2026-04-28 13:19

Updated : 2026-10-26 21:10

NVD link : CVE-2026-7309

Mitre link : CVE-2026-7309

CVE.ORG link : CVE-2026-7309

JSON object : View

Products Affected

redhat

openshift_container_platform

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-7309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T13:32:12.175488Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ose-openshift-controller-manager-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-28T13:19:24.847", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-7309", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463451", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el sistema de compilaci\u00f3n de OpenShift Container Platform. Un usuario con el ClusterRole \u2019edit\u2019 puede inyectar variables de entorno arbitrarias, como \u2019LD_PRELOAD\u2019 o \u2019http_proxy\u2019, en contenedores \u2019docker-build\u2019 a trav\u00e9s de la API \u2019buildconfigs/instantiate\u2019. Esta correcci\u00f3n incompleta para una vulnerabilidad anterior permite la revelaci\u00f3n de informaci\u00f3n, impactando espec\u00edficamente la confidencialidad del tr\u00e1fico de compilaci\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}