It was reported that by creating a new image with root password changed and using it as a sti builder image, attackers are able to gain ROOT in it. Overridding builder image scripts(e.g. assemble) can help the attackers to access the pod and/or perform remote command execution in it.

Product bugs (contain reproducer):

https://bugzilla.redhat.com/showbug.cgi?id=1315187 https://bugzilla.redhat.com/showbug.cgi?id=1315188

Upstream bug:

https://github.com/openshift/origin/pull/7864