CVE-2026-7309: Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection
A flaw was found in the OpenShift Container Platform build system. A user with the edit ClusterRole can inject arbitrary environment variables, such as LDPRELOAD or httpproxy, into docker-build containers through the buildconfigs/instantiate API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.
Other sources
An incomplete fix for CVE-2024-45496 was identified in the OpenShift Container Platform build system. The buildconfigs/instantiate API still accepts arbitrary environment variable names (including LDPRELOAD, PATH, BUILDAHRUNTIME, DOCKERCONFIG, httpproxy, httpsproxy) that propagate to the docker-build container, which remains privileged: true.
A user with the stock edit ClusterRole can inject these env vars into any BuildConfig in the namespace. The env var name validation only applies a format regex with no semantic deny-list for dangerous names.
In stock OpenShift, the edit role already grants Secret read access, making proxy interception largely redundant. The practical impact is limited to unsupported minimal role configurations.
Affected: openshift/api build/v1/consts.go Tested on: OCP 4.21.0 CVE-2024-45496 fix applied but env injection into docker-build remains.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the buildconfigs/instantiate API (used by BuildConfig instantiate) so that only highly trusted users can call it; users with the `edit` ClusterRole can inject arbitrary environment variables (e.g., `LD_PRELOAD`, `http_proxy`) into `docker-build` containers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7309?
CVE-2026-7309 is classified as a medium severity vulnerability.
How do I fix CVE-2026-7309?
To mitigate CVE-2026-7309, limit the ClusterRole permissions for users and avoid granting the 'edit' ClusterRole unnecessarily.
What type of vulnerability is CVE-2026-7309?
CVE-2026-7309 is an information disclosure vulnerability due to environment variable injection.
Who is affected by CVE-2026-7309?
Users with the 'edit' ClusterRole in the OpenShift Container Platform are affected by CVE-2026-7309.
What are the potential impacts of CVE-2026-7309?
CVE-2026-7309 can allow an attacker to inject arbitrary environment variables, potentially leading to unauthorized access or data exposure.