Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-82976— Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

Quick assessment

Affected
Red Hat Red Hat OpenShift Container Platform 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenShift 的裸金属（bare metal）供应栈中使用的 组件中发现了一个安全漏洞。该控制器会在 8084 端口注册一个 HTTP 文件服务器，且未启用任何身份验证机制。其自定义的 实现在根路径下暴露了所有已注册镜像的可浏览 HTML 目录列表。针对每台主机的镜像，唯一的访问控制措施是使用随机生成的 UUID 作为文件名；然而，该目录列表会将这些 UUID 泄露给供应网络中的任意调用者。每个被服务的镜像都嵌入了一个 Ignition 配置文件，其中包含 base64 编码的集群拉取密钥（cluster

CVSS 7.1 · High

Affected Version Matrix 3

VendorProduct Version RangeStatus
Red Hat Red Hat OpenShift Container Platform 4 any affected
any affected
Red Hat Red Hat OpenShift Container Platform 5 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82976

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info("Open", "path", name) if name == "/" { return f, nil } ... ``` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** ```go http.Handle("/", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default ":8084" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"}, ... ``` ### Attack Pattern Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过目录枚举导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 5 - cpe:/a:redhat:openshift:5

II. Public POCs for CVE-2026-82976

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82976

请登录查看更多情报信息。

Other References for CVE-2026-82976 (4)

Same Patch Batch · Red Hat · 2026-11-03 · 6 CVEs total

CVE-2026-120830 7.4 HIGH Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information
CVE-2026-121259 6.5 MEDIUM Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 deci
CVE-2026-119843 6.5 MEDIUM Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/
CVE-2026-120831 6.5 MEDIUM Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
CVE-2026-120971 5.3 MEDIUM Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default excepti

IV. Related Vulnerabilities

Same product: Red Hat OpenShift Container Platform 4
Same vendor: Red Hat
Same weakness: CWE-548