CVE-2026-7309

MediumCVSS 4.3

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

Risk Assessment

A user with edit permissions could disclose data transmitted during builds, potentially leading to leakage of sensitive information.

Recommendation

Update OpenShift Container Platform to a version containing the complete fix or restrict the permissions of the `edit` role.

Other vulnerabilities in OpenShift Container Platform

CVE-2026-10533Medium
A flaw was found in OpenShift Container Platform where completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS