CVE-2026-7309

published 2026-04-28

CVE-2026-7309: A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
openshift4	ose-openshift-controller-manager-rhel9	—	—
redhat	openshift_container_platform	—	—

CWE-426