Red Hat OpenShift Container Platform: Information disclosure via directory listing in image server
Summary
The image-customization-controller used in the OpenShift bare metal provisioning stack runs an unauthenticated HTTP image server on port 8084 that lists all served images in a browsable directory. An adjacent attacker on the provisioning network can obtain the image UUIDs, download the images and extract the embedded Ignition configuration. This can expose the cluster pull secret and, if configured, the RAMDISK SSH key.
Affected
- Red Hat OpenShift Container Platform 4 (default: affected)
- Red Hat OpenShift Container Platform 5 (default: affected, listed by the CNA; unverified)
- Exact affected version ranges: Unknown.
Fixed in
Unknown. No fixed version has been confirmed in the sources reviewed.
Workaround
- No option exists to disable the directory listing or add authentication without a code change.
- Restrict access to TCP port 8084 on the image-customization-controller pod to required BMC and provisioning network hosts only, using NetworkPolicy or firewall rules.
- Block access to port 8084 from workload pods.
- If unauthorized access to the provisioning network is suspected, rotate the pull secrets and SSH keys that may have been exposed.
Exploitation
- Red Hat rates the issue Important (CVSS 7.1, adjacent network, no privileges, no user interaction).
- No public proof of concept, Metasploit or Exploit-DB module, or Nuclei template was found.
- No evidence of in-the-wild exploitation or inclusion in CISA KEV was found.
- VulDB rates the issue 5.3 with CWE-200; the CNA vector is used here as the baseline.
Our recommendation
- Check whether the organisation runs OpenShift bare metal provisioning (IPI). If not, the CVE is likely not applicable.
- If it does, segment the provisioning network now and verify with a scan from other VLANs that port 8084 is not reachable from user or guest networks.
- Check controller logs for unexpected requests and rotate the cluster pull secret and any RAMDISK SSH key if exposure is suspected.
- Apply the Red Hat fix once it is published and confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-82976 access.redhat.com
- Red Hat Bugzilla 2526334 bugzilla.redhat.com
- Red Hat Jira OCPBUGS-105396 redhat.atlassian.net
- image-customization-controller source repository github.com
- VulDB entry 430522 vuldb.com
- Offseq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 20:35.
Original description (NVD)
A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info("Open", "path", name) if name == "/" { return f, nil } ... ``` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** ```go http.Handle("/", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default ":8084" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"}, ... ``` ### Attack Pattern Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.