PT-2026-136351
CVE-2026-82976
·
Publicado
2026-11-03
·
Atualizado
2026-11-03
Descrição por
CVSS 3.1
7.1
AltaMétricasAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC RAMDISK SSH KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.
Evidence
pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names
go
func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {
f.mu.Lock()
defer f.mu.Unlock()
result := []fs.FileInfo{}
for , im := range f.images {
result = append(result, im)
}
return result, nil
}
func (f *imageFileSystem) Open(name string) (http.File, error) {
f.log.Info("Open", "path", name)
if name == "/" {
return f, nil
}
...cmd/controller/main.go — file server bound on all interfaces without auth or TLS
go
http.Handle("/", http.FileServer(imageServer.FileSystem()))
go func() {
server := &http.Server{
Addr: imagesBindAddr, // default ":8084"
ReadHeaderTimeout: 5 * time.Second,
}
err := server.ListenAndServe()pkg/ignition/service config.go:94-100 — pull secret is embedded in every served image
go
func (b *ignitionBuilder) authFile() ignition config types 32.File {
source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret)
return ignition config types 32.File{
Node: ignition config types 32.Node{Path: "/etc/authfile.json"},
...Attack Pattern
Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.
Explorabilidade
Correção
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾