Ghostwire

CVE-2026-7309: A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject...

MEDIUM CVSS 5.5

Published: April 28, 2026 | Last Modified: April 28, 2026

Description

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

Ghostwire Analysis — What This Means Practically

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References