CVE-2026-7309
Environment Variable Injection in OpenShift Build System Risks Data Exposure
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | openshift_container_platform | * |
| redhat | openshift_container_platform | 4.21.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7309 is a medium severity information disclosure vulnerability in the OpenShift Container Platform's build system. It occurs because users with the 'edit' ClusterRole can inject arbitrary environment variables, including sensitive ones like LD_PRELOAD and http_proxy, into docker-build containers via the buildconfigs/instantiate API.
This vulnerability is due to an incomplete fix for a previous issue (CVE-2024-45496). The environment variable name validation only checks the format but does not block dangerous variable names, allowing injection of potentially harmful environment variables.
The injection can happen within any BuildConfig in the user's namespace, and since the 'edit' role also grants Secret read access, the risk is somewhat limited to certain configurations.
How can this vulnerability impact me? :
This vulnerability can lead to information disclosure by allowing an attacker with 'edit' permissions to inject environment variables into build containers, potentially exposing confidential build traffic.
Although the risk is limited by the default permissions associated with the 'edit' role, in unsupported minimal role configurations, the impact could be more significant.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the injection of arbitrary environment variables into docker-build containers via the buildconfigs/instantiate API by users with the 'edit' ClusterRole.
To detect this vulnerability on your system, you can audit the environment variables being passed to docker-build containers, especially looking for suspicious or unexpected variables such as LD_PRELOAD, http_proxy, https_proxy, PATH, BUILDAH_RUNTIME, and DOCKER_CONFIG.
You may also review the permissions of users with the 'edit' ClusterRole to see if they have the ability to instantiate BuildConfigs with injected environment variables.
Suggested commands include:
- Use `oc get buildconfigs -o yaml` to inspect BuildConfig definitions for environment variables.
- Use `oc describe build <build-name>` to check environment variables used in builds.
- Audit user roles with `oc get clusterrolebindings` and `oc get rolebindings` to identify users with 'edit' permissions.
- Monitor network traffic for unusual proxy or LD_PRELOAD environment variable usage during builds.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the 'edit' ClusterRole permissions to trusted users only, as this role allows environment variable injection into BuildConfigs.
Implement stricter validation or deny-lists for environment variable names in the buildconfigs/instantiate API to block dangerous variables like LD_PRELOAD and proxy-related variables.
Review and limit Secret read access for users with the 'edit' role to reduce the risk of information disclosure.
Apply any available patches or updates from OpenShift Container Platform that address this vulnerability.
Monitor build traffic for signs of information leakage or suspicious environment variable injection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows users with the 'edit' ClusterRole to inject arbitrary environment variables into docker-build containers, leading to information disclosure that impacts the confidentiality of build traffic.
Since confidentiality is a key aspect of compliance with standards such as GDPR and HIPAA, this flaw could potentially undermine compliance by exposing sensitive build information.
However, the practical impact is limited because the 'edit' role also grants Secret read access, and the risk of proxy interception is mainly relevant in unsupported minimal role configurations.