CVE-2026-7309
published 2026-04-28CVE-2026-7309: A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.18%
7.7th percentile
A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-openshift-controller-manager-rhel9 | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rgq5-8c8j-9wq5: A flaw was found in the OpenShift Container Platform build system
ghsa_unreviewed·2026-04-28
CVE-2026-7309 [MEDIUM] CWE-426 GHSA-rgq5-8c8j-9wq5: A flaw was found in the OpenShift Container Platform build system
A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.
VulDB
Red Hat OpenShift Container Platform 4 Environment Variable LD_PRELOAD/http_proxy information disclosure
vuldb·2026-04-28·CVSS 4.3
CVE-2026-7309 [MEDIUM] Red Hat OpenShift Container Platform 4 Environment Variable LD_PRELOAD/http_proxy information disclosure
A vulnerability classified as problematic has been found in Red Hat OpenShift Container Platform 4. This vulnerability affects unknown code of the component Environment Variable Handler. Performing a manipulation of the argument LD_PRELOAD/http_proxy results in information disclosure.
This vulnerability is reported as CVE-2026-7309. The attack is possible to be carried out remotely. No exploit exists.
Red Hat
openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
vendor_redhat·2026-04-28·CVSS 4.3
CVE-2026-7309 [MEDIUM] CWE-426 openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.
Statement: This vulnerability relies on the proxy env var whitelist in the BuildConfig API, but the practical exploitability is limited by the fact that users with the required permissions (edit role) already have direct secret read access. The "minimal role" scenario is pote
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43110 kernel: wifi: brcmfmac: validate bsscfg indices in IF events
bugzilla·2026-05-06
CVE-2026-43110 [HIGH] CVE-2026-43110 kernel: wifi: brcmfmac: validate bsscfg indices in IF events
CVE-2026-43110 kernel: wifi: brcmfmac: validate bsscfg indices in IF events
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: validate bsscfg indices in IF events
brcmf_fweh_handle_if_event() validates the firmware-provided interface
index before it touches drvr->iflist[], but it still uses the raw
bsscfgidx field as an array index without a matching range check.
Reject IF events whose bsscfg index does not fit in drvr->iflist[]
before indexing the interface array.
[add missing wifi prefix]
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43110-7309@gregkh/T
Bugzilla
CVE-2026-7309 openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
bugzilla·2026-04-28·CVSS 9.9
CVE-2026-7309 [CRITICAL] CVE-2026-7309 openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
CVE-2026-7309 openshift-controller-manager: OpenShift Container Platform: Information disclosure via environment variable injection
An incomplete fix for CVE-2024-45496 was identified in the OpenShift Container Platform build system. The buildconfigs/instantiate API still accepts arbitrary environment variable names (including LD_PRELOAD, PATH, BUILDAH_RUNTIME, DOCKER_CONFIG, http_proxy, https_proxy) that propagate to the docker-build container, which remains privileged: true.
A user with the stock edit ClusterRole can inject these env vars into any BuildConfig in the namespace. The env var name validation only applies a format regex with no semantic deny-list for dangerous names.
In stock OpenShift, the edit role already grants Secret read access, making proxy interception largely redu
2026-04-28
Published