CVE-2026-7309

🔶 medium

Summary

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

CVSS Score

4.3

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-04-28

First Seen: 2026-05-10

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.4% of all 322,079 vulnerabilities in our database.

#304,591

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 28, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Red Hat would like to thank Rohit Sanjay Khandke for reporting this issue.

SSVC data provided by CISA

Last Modified 2026-05-07

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE IDs (Weakness Types)

CWE-426

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
redhat	openshift_container_platform	Affected	v4.0

🔗 References 2

https://access.redhat.com/security/cve/CVE-2026-7309

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2463451

Issue Tracking Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42010	⚠️ high	7.1	0.2	A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully ma...	2026-05-07
CVE-2026-33845	⚠️ high	7.5	0.0	A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an i...	2026-04-30
CVE-2026-3832	ℹ️ low	3.7	0.0	A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online ...	2026-04-30
CVE-2026-3833	🔶 medium	6.5	0.1	A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstra...	2026-04-30
CVE-2026-6732	🔶 medium	6.5	0.1	A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definit...	2026-04-23
CVE-2026-31431	⚠️ high	7.8	2.4	In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla...	2026-04-22

These CVEs affect the same products