What is the CVSS score of CVE-2026-7309?

CVE-2026-7309 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

OpenShift Container Platform CVE-2026-7309

EUVD-2026-26043 MEDIUM

Untrusted Search Path (CWE-426)

2026-04-28 secalert@redhat.com

Docker Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 13:31 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 13:22 euvd

EUVD-2026-26043

Analysis Generated

Apr 28, 2026 - 13:22 vuln.today

CVE Published

Apr 28, 2026 - 13:19 nvd

MEDIUM 4.3

DescriptionCVE.org

A flaw was found in the OpenShift Container Platform build system. A user with the edit ClusterRole can inject arbitrary environment variables, such as LD_PRELOAD or http_proxy, into docker-build containers through the buildconfigs/instantiate API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

AnalysisAI

OpenShift Container Platform build system allows authenticated users with the edit ClusterRole to inject arbitrary environment variables into docker-build containers via the buildconfigs/instantiate API, enabling information disclosure attacks such as build traffic interception through LD_PRELOAD or http_proxy manipulation. This represents an incomplete remediation of a prior vulnerability, affecting confidentiality of sensitive build data with CVSS 4.3 (network-accessible, low complexity, authenticated). No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exploits inadequate input validation in the OpenShift Container Platform's build system, specifically the buildconfigs/instantiate API endpoint. Docker build containers inherit environment variables from the build configuration, and the API fails to sanitize or restrict injection of dangerous variables like LD_PRELOAD (which can load arbitrary shared libraries into processes) or http_proxy (which can redirect network traffic through attacker-controlled proxies). This is rooted in CWE-426 (Untrusted Search Path) and related environment variable injection patterns. The flaw affects users who possess the edit ClusterRole, a built-in Kubernetes RBAC role that grants broad permissions within a namespace. The incomplete fix suggests a prior patch (likely for CVE-2026-7308 or similar) did not fully address all injection vectors in the API.

RemediationAI

Apply the vendor-released patch from Red Hat for CVE-2026-7309 by consulting the security advisory at https://access.redhat.com/security/cve/CVE-2026-7309 and upgrading to the patched OCP release. Patch details and exact fixed versions are not provided in the current intelligence; check the Red Hat advisory for the minimum patched version for each OCP release line. As an interim compensating control, restrict the assignment of the edit ClusterRole to only trusted, internal development teams and implement RBAC policies that follow the principle of least privilege - use more granular roles (e.g., developer or build-related roles with narrower scope) where possible. Additionally, implement network segmentation and egress filtering to prevent build containers from communicating with external proxies or untrusted hosts, mitigating the impact of http_proxy injection. Monitor API audit logs for suspicious buildconfigs/instantiate requests with unusual environment variable payloads (LD_PRELOAD, *_PROXY, *_LD_*). Note that these controls do not prevent exploitation by authorized edit-role users; full remediation requires the patch.